Function at 0x441604
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.004069c4
xor eax, eax
push ebp
push 0x442092
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x2c]
call fcn.00404764
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x48]
cmp eax, edx
jle 0x441669
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x24]
add eax, 0x318
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x30]
call fcn.00404764
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jne 0x441645
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x2c]
call fcn.0041d488
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x4416e9
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
add eax, 0x17
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404764
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x34]
jne 0x4416d8
mov eax, dword [ebp - 0x20]
imul dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
fild dword [ebp - 0x34]
call fcn.00404764
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x2c], 1
jl 0x4416a7
mov byte [ebp - 9], 0
xor eax, eax
push ebp
push 0x441f6e
push dword fs:[eax]
mov dword fs:[eax], esp
imul eax, dword [ebp - 0x4c], 0x1b6
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x24]
call fcn.0043f4f8
mov ecx, 1
mov edx, 0x4420b0
mov eax, 0x4420d0
call fcn.004077fc
cmp eax, 0x52
jge 0x441731
fild dword [ebp - 0x34]
call fcn.00404770
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x2c]
jle 0x441758
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x34]
call fcn.0042036c
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.0043e9cc
sub ecx, ebx
mov edx, 1
test eax, ebx
cmp edx, 0
ja 0x441775
fisttp word [ebp + 0x558b8045]
cld
lea eax, [ebp - 0x80]
mov edx, dword [ebp - 4]
call fcn.004073c0
mov eax, dword [ebp - 0x80]
lea edx, [ebp - 0x7c]
call fcn.00414b7c
mov edx, dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
call fcn.004073d4
mov eax, dword [ebp - 0x78]
call fcn.00440ffc
mov eax, dword [ebp - 0x20]
imul dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x4417f1
inc dword [ebp - 0x2c]
mov eax, 0x308
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x38]
call fcn.00404770
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x48]
cmp eax, edx
jle 0x4417e5
imul eax, dword [ebp - 0x50], 0x1f7
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x2c], 1
jl 0x4417b2
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
add eax, 0x345
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x30]
call fcn.00404764
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x3c]
add eax, 4
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404770
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x34]
jne 0x441834
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jne 0x4417f6
mov eax, dword [ebp - 0x44]
add eax, 0x165
mov dword [ebp - 0x3c], eax
mov ecx, 1
mov edx, 0x4420b0
mov eax, 0x4420f4
call fcn.004077fc
cmp eax, 0x17
je 0x441870
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x4418cd
inc dword [ebp - 0x2c]
mov eax, 0x2e5
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
add eax, 4
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404770
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x34]
jne 0x4418b1
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jge 0x4418c7
mov eax, 0x35f
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x2c], 1
jl 0x44187b
mov eax, dword [ebp - 0x48]
sub eax, 0x1a5
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x70]
lea eax, [ebp - 0x5c]
call fcn.0043ea2c
test al, al
je 0x441f64
mov ecx, 1
mov edx, 0x4420b0
mov eax, 0x442114
call fcn.004077fc
cmp eax, 0x4d
jge 0x44190f
fild dword [ebp - 0x34]
call fcn.00404764
mov dword [ebp - 0x2c], eax
cmp dword [0x47a6d8], 0
jne 0x44192c
mov edx, 0x86cba2
mov eax, dword [0x47a5e4]
call fcn.0041abc0
mov dword [0x47a6d8], eax
mov ecx, 1
mov edx, 0x4420b0
mov eax, 0x442138
call fcn.004077fc
cmp eax, 0x56
jge 0x441959
mov eax, dword [ebp - 0x38]
add eax, 4
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404770
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00407094
mov edx, eax
lea eax, [ebp - 0x84]
call fcn.00407030
mov eax, dword [ebp - 0x84]
call fcn.0043f65c
test al, al
je 0x44198b
mov eax, dword [ebp - 4]
call fcn.00407094
push eax
call sub.kernel32.dll_DeleteFileW
call fcn.0041aef0
mov ecx, 1
mov edx, 0x4420b0
mov eax, 0x44215c
call fcn.004077fc
cmp eax, 0x25
je 0x4419b2
mov eax, dword [ebp - 0x20]
imul dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x1c]
call fcn.004068c0
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x4812ec]
call fcn.004074dc
mov ecx, 1
mov edx, 0x4420b0
mov eax, 0x44217c
call fcn.004077fc
cmp eax, 0x17
je 0x4419f3
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x48129c]
call fcn.004074dc
mov eax, dword [ebp - 0x48]
sub eax, 0x1ab
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x4812bc]
call fcn.004074dc
lea eax, [ebp - 0x1c]
mov edx, dword [0x4812d4]
call fcn.004074dc
mov eax, dword [ebp - 0x44]
add eax, 0x128
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x4812d4]
call fcn.004074dc
fild dword [ebp - 0x24]
call fcn.00404764
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x1c]
mov edx, 0x44218c
call fcn.004074dc
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x4812bc]
call fcn.004074dc
mov ecx, 1
mov edx, 0x4420b0
mov eax, 0x44219c
call fcn.004077fc
cmp eax, 0x56
jge 0x441a94
fild dword [ebp - 0x38]
call fcn.00404770
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x4812d4]
call fcn.004074dc
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x1c]
mov edx, dword [0x4812d4]
call fcn.004074dc
cmp dword [0x47a5e8], 0
jne 0x441ad6
mov eax, dword [ebp - 0x1c]
call fcn.004072e0
push eax
call dword [0x47a668]
mov dword [0x47a5e8], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x441b24
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
add eax, 0x30e
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
add eax, 0x13
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404764
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x38]
jne 0x441b14
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x50], eax
imul eax, dword [ebp - 0x30], 0x3a4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x2c], 1
jl 0x441ae1
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x40]
cmp eax, edx
jge 0x441b53
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x40]
call fcn.0042bf9c
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x441ba4
inc dword [ebp - 0x2c]
imul eax, dword [ebp - 0x24], 0x301
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x40]
add eax, 0x46
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404764
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x38]
jne 0x441b93
mov eax, dword [ebp - 0x20]
imul dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
add eax, 0x336
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x2c], 1
jl 0x441b5e
cmp dword [0x47a6ec], 0
jne 0x441bc1
mov edx, 0x8938c0
mov eax, dword [0x47a5e4]
call fcn.0041abc0
mov dword [0x47a6ec], eax
xor eax, eax
mov dword [ebp - 0x34], eax
fild dword [ebp - 0x2c]
call fcn.00404770
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x38]
jne 0x441be5
mov eax, dword [ebp - 0x20]
imul dword [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov eax, 0x34b
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x30]
call fcn.00404764
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jne 0x441bc6
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x441c5b
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
add eax, 0x320
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x30], 0x3e5
mov dword [ebp - 0x28], eax
fild dword [ebp - 0x38]
call fcn.00404770
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x44]
cmp eax, edx
jle 0x441c55
imul eax, dword [ebp - 0x4c], 0x1d4
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x2c], 1
jl 0x441c18
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x44]
cmp eax, edx
jge 0x441c81
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x50]
lea edx, [ebp - 0x48]
lea eax, [ebp - 0x3c]
call fcn.0042c020
cmp dword [0x47a720], 0
jne 0x441c9e
mov edx, 0xc93a45
mov eax, dword [0x47a5e8]
call fcn.0041abc0
mov dword [0x47a720], eax
imul eax, dword [ebp - 0x4c], 0x1d7
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jle 0x441cb8
lea eax, [ebp - 0x38]
call fcn.00421ff8
imul eax, dword [ebp - 0x48], 0x1a8
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x34]
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.0043e9cc
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x40]
cmp eax, edx
jge 0x441ce5
call fcn.004270b8
push 0
push 0x80
push 1
lea eax, [ebp - 0x5c]
push eax
push 3
push 0xc0000000
mov eax, dword [ebp - 4]
call fcn.00407094
push eax
call dword [0x47a6ec]
mov dword [ebp - 0x10], eax
call dword [0x47a720]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x441f64
cmp dword [ebp - 0x18], 0
jne 0x441f64
xor eax, eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
add eax, 4
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404770
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x38]
jne 0x441d52
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x30]
add eax, 4
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404770
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x34]
jne 0x441d7a
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jne 0x441d2d
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
add eax, 0x32b
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x30], 0x3f0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
add eax, 4
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404770
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x34]
jne 0x441dcb
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jge 0x441de1
mov eax, 0x349
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jne 0x441d8e
imul eax, dword [ebp - 0x4c], 0x1d0
mov dword [ebp - 0x44], eax
call fcn.00441500
cmp dword [0x47a6f4], 0
jne 0x441e16
mov edx, 0x72adfe
mov eax, dword [0x47a5e4]
call fcn.0041abc0
mov dword [0x47a6f4], eax
mov eax, dword [ebp - 0x44]
sub eax, 0x161
mov dword [ebp - 0x3c], eax
mov ecx, 1
mov edx, 0x4420b0
mov eax, 0x4421c0
call fcn.004077fc
cmp eax, 0x4a
jge 0x441e45
fild dword [ebp - 0x30]
call fcn.00404764
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jle 0x441e6c
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x3c]
lea eax, [ebp - 0x34]
call fcn.00421a64
mov eax, dword [ebp - 0x44]
add eax, 0x124
mov dword [ebp - 0x38], eax
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
call fcn.0041f14c
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WriteFile_2
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 9], al
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, 0x372
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
add eax, 0x78
mov dword [ebp - 0x74], eax
fild dword [ebp - 0x74]
call fcn.00404764
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x3c]
jne 0x441ed4
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, 0x388
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 3
jne 0x441ea4
imul eax, dword [ebp - 0x4c], 0x1ae
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x34]
lea eax, [ebp - 0x28]
call fcn.0041ab58
imul eax, dword [ebp - 0x4c], 0x1bb
mov dword [ebp - 0x44], eax
cmp dword [0x47a6a0], 0
jne 0x441f2b
mov edx, 0x78a43f
mov eax, dword [0x47a5e4]
call fcn.0041abc0
mov dword [0x47a6a0], eax
mov ecx, 1
mov edx, 0x4420b0
mov eax, 0x4421e4
call fcn.004077fc
cmp eax, 0x56
jge 0x441f4f
fild dword [ebp - 0x38]
call fcn.00404770
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
push eax
call dword [0x47a6a0]
lea edx, [ebp - 0x4c]
lea eax, [ebp - 0x2c]
call fcn.0041c548
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x441fc6
xor eax, eax
mov dword [ebp - 0x34], eax
imul eax, dword [ebp - 0x30], 0x3ae
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x44]
cmp eax, edx
jle 0x441fee
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
imul eax, dword [ebp - 0x30], 0x3c3
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jne 0x441fcb
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jle 0x442032
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x40]
lea eax, [ebp - 0x34]
call fcn.00420bc8
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jle 0x442054
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x30]
call fcn.0041ec48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442099
lea eax, [ebp - 0x84]
call fcn.00406908
lea eax, [ebp - 0x80]
mov edx, 2
call fcn.00406920
lea eax, [ebp - 0x78]
call fcn.00406908
lea eax, [ebp - 0x1c]
call fcn.004068c0
lea eax, [ebp - 4]
call fcn.00406908
ret