Function at 0x401074
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
mov eax, 0x14dc
push esi
push ebx
call fcn.0041f3f0
sub esp, eax
mov edi, dword [esp + 0x14fc]
mov esi, dword [esp + 0x14f4]
mov ebx, dword [esp + 0x14f8]
test edi, edi
jle 0x4010d4
mov eax, dword [esp + 0x14f0]
cmp dword [0x422844], eax
jne 0x4010d4
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x42e280
mov dword [esp], 0x42e4a0
call fcn.00403cb2
lea eax, [esi + 0x69]
cmp al, 0x52
ja case.0x4010e2.1
movzx eax, al
jmp dword [eax*4 + 0x422a1c]
lea ebx, [esp + 0x2cc]
lea esi, [esp + 0xcc]
mov dword [esp + 4], 0x200
mov dword [esp], ebx
call fcn.0041317c
mov dword [esp + 4], 0x40
mov dword [esp], esi
call fcn.0041321e
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x4d0]
mov dword [esp + 0x10], esi
mov dword [esp + 8], str._s_a_s_a
mov dword [esp + 4], 0x1000
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x97
jmp 0x40122d
lea eax, [ebx + 0x20]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.0040a3de
test al, al
je 0x401241
lea ebx, [esp + 0x8c]
lea esi, [esp + 0x4c]
lea edi, [esp + 0xcc]
mov dword [esp + 4], 0x40
lea ebp, [esp + 0x2cc]
mov dword [esp], ebx
call fcn.004130e8
mov dword [esp + 4], 0x40
mov dword [esp], esi
call fcn.00413040
mov dword [esp + 4], 0x200
mov dword [esp], edi
call fcn.004134d1
mov dword [esp + 4], 0x200
mov dword [esp], ebp
call fcn.0041317c
mov dword [esp + 0x18], ebx
lea ebx, [esp + 0x4d0]
mov dword [esp + 0x28], 0x42e244
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0x42e224
mov dword [esp + 0x10], 0x2003100
mov dword [esp + 0xc], 1
mov dword [esp + 8], str._c_.8x_s_a_s____s_a_s_a_s_a_s_a
mov dword [esp + 4], 0x1000
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x9b
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.00405d7d
jmp case.0x4010e2.1
mov dword [esp], 0x2710
call fcn.00407ef4
lea eax, [esp + 0x14f0]
mov dword [esp], eax
call fcn.00405999
jmp case.0x4010e2.1
mov dword [esp], 0x61c
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je case.0x4010e2.1
mov dword [esp], ebx
mov dword [esp + 0x10], 0x204
lea edi, [esp + 0x4d0]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 7
call fcn.004129fb
lea eax, [esi + 0x204]
mov dword [esp], ebx
mov dword [esp + 0x10], 0x204
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp + 0xc], eax
call fcn.004129fb
mov dword [esp], ebx
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], edi
mov dword [esp + 8], 3
mov dword [esp + 4], 7
call fcn.004129fb
mov dword [esp], edi
call fcn.00412666
mov dword [esi + 0x610], eax
mov dword [esp], ebx
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], edi
mov dword [esp + 8], 4
mov dword [esp + 4], 7
call fcn.004129fb
mov dword [esp], str.TEMP
call sub.msvcrt.dll_getenv
mov dword [esp], str._6_6.dfd
mov ebx, eax
call fcn.004081aa
mov dword [esp + 8], eax
lea eax, [esi + 0x408]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 0x204
mov dword [esp], eax
call fcn.004127a8
mov eax, dword [esp + 0x14f0]
mov dword [esi + 0x614], 0
mov dword [esi + 0x618], eax
mov dword [esp + 4], esi
mov dword [esp], 0x41458d
jmp 0x401632
lea esi, [esp + 0x4d0]
mov dword [esp + 8], 0x1000
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.00412d73
mov eax, dword [esp + 0x14f0]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00414470
jmp case.0x4010e2.1
lea eax, [esp + 0x14f0]
mov dword [esp], eax
call fcn.00405999
call fcn.00401000
mov dword [esp], 0x7d0
call fcn.00407ef4
jmp case.0x4010e2.1
call fcn.004089ed
lea eax, [esp + 0x14f0]
mov dword [esp], eax
call fcn.00405999
call fcn.00401000
call fcn.00408af3
call sub.WS2_32.dll_WSACleanup
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
mov dword [esp + 4], ebx
mov dword [esp], 0x42e220
call fcn.004092b2
jmp case.0x4010e2.1
mov dword [esp], 0x61c
call sub.msvcrt.dll_malloc
test eax, eax
mov ebp, eax
je case.0x4010e2.1
mov dword [esp + 0x10], 0x204
mov dword [esp + 0xc], eax
lea edi, [esp + 0xcc]
mov dword [esp + 8], 1
mov dword [esp + 4], 7
mov esi, str._s_s._s
mov dword [esp], ebx
call fcn.004129fb
lea eax, [ebp + 0x204]
mov dword [esp + 0x10], 0x204
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.004129fb
lea eax, [esp + 0x4d0]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 8], 3
mov dword [esp + 4], 7
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.004129fb
lea eax, [esp + 0x4d0]
mov dword [esp], eax
call fcn.00412666
mov dword [ebp + 0x610], eax
lea eax, [esp + 0x4d0]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 8], 4
mov dword [esp + 4], 7
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.004129fb
lea eax, [esp + 0x2cc]
mov dword [esp + 8], 0x10
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.00412cd5
test eax, eax
mov ecx, 9
mov byte [esp + 0x8c], 0x25
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x8d], 0x73
mov byte [esp + 0x8e], 0x5c
mov byte [esp + 0x8f], 0x25
mov byte [esp + 0x90], 0x73
mov byte [esp + 0x91], 0
mov dword [esp], str.TEMP
jle 0x40159b
call sub.msvcrt.dll_getenv
lea edx, [esp + 0x2cc]
mov dword [esp + 0xc], eax
lea eax, [esp + 0xcc]
mov dword [esp + 4], 0x204
mov dword [esp + 0x14], edx
mov dword [esp + 8], eax
lea edx, [esp + 0x4d0]
lea eax, [ebp + 0x408]
mov dword [esp + 0x10], edx
mov dword [esp], eax
call fcn.004127a8
jmp 0x4015d0
call sub.msvcrt.dll_getenv
mov dword [esp + 0xc], eax
lea eax, [esp + 0x8c]
lea edx, [esp + 0x4d0]
mov dword [esp + 4], 0x204
mov dword [esp + 8], eax
lea eax, [ebp + 0x408]
mov dword [esp + 0x10], edx
mov dword [esp], eax
call fcn.004127a8
lea eax, [esp + 0x4d0]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 8], 5
mov dword [esp + 4], 7
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.004129fb
lea eax, [esp + 0x4d0]
mov dword [esp], eax
call fcn.00412666
test eax, eax
mov dword [ebp + 0x618], 0
mov dword [ebp + 0x614], 0
setne byte [ebp + 0x60c]
mov dword [esp + 4], ebp
mov dword [esp], fcn.004093e7
call fcn.00407f08
jmp case.0x4010e2.1
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.00406304
jmp case.0x4010e2.1
mov eax, dword [esp + 0x14f0]
mov dword [esp + 4], ebx
lea ebx, [esp + 0x4d0]
mov dword [esp + 8], 0x204
mov byte [esp + 0x6d5], 0xa7
mov dword [esp], ebx
mov byte [esp + 0x6d4], 0xa6
mov dword [esp + 0x6d8], eax
mov byte [esp + 0x6dc], 0
call fcn.00412548
jmp 0x4019e7
mov dword [esp], 0x230
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je case.0x4010e2.1
movsx edx, byte [ebx]
add ebx, 2
mov dword [esi + 0x204], 0
mov byte [esi + 0x20c], 0xab
mov byte [esi + 0x20d], 0xac
mov byte [esi + 0x20e], 0xad
mov eax, edx
mov dword [esi + 0x208], edx
mov edx, dword [esp + 0x14f0]
mov dword [esi + 0x210], edx
mov dl, byte [ebx - 1]
test al, al
mov byte [esi + 0x228], dl
je 0x40179b
dec al
jne 0x401812
lea edi, [esp + 0x4d0]
lea ebp, [esp + 0x2cc]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 8], 1
mov dword [esp + 4], 7
mov dword [esp + 0xc], edi
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp + 8], 0x204
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00412d73
mov dword [esp + 8], 0x204
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.00412c0f
mov dword [esp], ebp
call fcn.00407b16
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], edi
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp], edi
call fcn.004126af
mov dword [esi + 0x220], eax
mov dword [esi + 0x224], edx
jmp 0x401812
lea edi, [esp + 0x4d0]
mov dword [esp + 0x10], 0x204
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], edi
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp], edi
call fcn.004126af
mov dword [esi + 0x220], eax
mov dword [esi + 0x224], edx
mov dword [esp], esi
call fcn.004074c5
mov dword [esi + 0x218], eax
mov dword [esi + 0x21c], edx
mov dword [esp + 4], esi
mov dword [esp], 0x413eb3
jmp 0x401632
mov eax, dword [esp + 0x14f0]
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004143f2
jmp case.0x4010e2.1
mov dword [esp], 0x214
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je case.0x4010e2.1
movsx eax, byte [ebx]
add ebx, 2
mov byte [esi + 0x210], 1
mov dword [esi + 0x204], eax
mov eax, dword [esp + 0x14f0]
mov dword [esi + 0x208], eax
movzx eax, byte [ebx - 1]
mov dword [esi + 0x20c], eax
mov dword [esp + 8], 0x204
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00412548
mov dword [esp + 4], esi
mov dword [esp], 0x413d4e
jmp 0x401632
movzx eax, byte [ebx]
mov dword [esp], eax
call fcn.00413a29
jmp case.0x4010e2.1
movzx eax, byte [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.004120c4
jmp case.0x4010e2.1
mov dword [esp], ebx
call fcn.00412666
mov dword [esp], eax
call fcn.004121c0
jmp case.0x4010e2.1
mov dword [esp], ebx
call fcn.00412666
mov dword [esp], eax
call fcn.00412191
jmp case.0x4010e2.1
lea eax, [esp + 0x4d0]
mov dword [esp + 8], 6
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00412aa3
mov eax, dword [esp + 0x4d0]
mov dword [esp], eax
mov eax, dword [esp + 0x4d4]
mov word [esp + 4], ax
call fcn.004122a3
jmp case.0x4010e2.1
lea eax, [esp + 0x4d0]
mov dword [esp + 8], 6
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00412aa3
mov eax, dword [esp + 0x4d0]
mov dword [esp], eax
mov eax, dword [esp + 0x4d4]
mov word [esp + 4], ax
call fcn.004121ef
jmp case.0x4010e2.1
mov dword [esp], 0x40
call fcn.004082e8
test al, al
mov eax, dword [esp + 0x14f0]
jne 0x4019a1
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0
mov dword [esp + 4], 0xcd
jmp 0x401234
lea ebx, [esp + 0x4d0]
mov dword [esp + 0xc], str.C:UsersAdministratorAppDataRoamingLogs_
mov dword [esp + 8], 0x422a09
mov dword [esp + 4], 0x204
mov dword [esp + 0x6d8], eax
mov dword [esp], ebx
mov byte [esp + 0x6d4], 0xcc
mov byte [esp + 0x6d5], 0xcd
mov byte [esp + 0x6dc], 0
call fcn.004127a8
mov dword [esp], ebx
call fcn.00406453
jmp case.0x4010e2.1
mov eax, dword [esp + 0x14f0]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00409ffd
jmp case.0x4010e2.1
mov dword [esp], ebx
call fcn.0040a115
jmp case.0x4010e2.1
mov dword [esp], ebx
call fcn.0040a1d5
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x4d0]
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._s_a_d
mov dword [esp + 4], 0x1000
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0xce
jmp 0x40122d
mov dword [esp], 0x40a
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je case.0x4010e2.1
cmp byte [ebx + 1], 1
sete byte [eax + 0x408]
add ebx, 2
mov dword [esp + 0x10], 0x204
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
lea eax, [esi + 0x204]
mov dword [esp + 0x10], 0x204
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.004129fb
mov byte [esi + 0x409], 1
mov dword [esp + 4], esi
mov dword [esp], 0x40746e
jmp 0x401632
lea esi, [esp + 0x4d0]
lea edi, [esp + 0x2cc]
lea ebp, [esp + 0xcc]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 8], 1
mov dword [esp + 0xc], esi
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp + 0x10], 0x104
mov dword [esp + 0xc], edi
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 3
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp], ebp
call fcn.00412666
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.00406c2a
jmp case.0x4010e2.1
lea esi, [esp + 0x4d0]
lea ebp, [esp + 0x2cc]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 8], 1
mov dword [esp + 4], 7
mov dword [esp + 0xc], esi
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp + 0x10], 0x104
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.00406e7f
test al, al
je case.0x4010e2.1
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xb0
jmp 0x40122d
mov dword [esp], ebx
call fcn.00406e04
test al, al
je case.0x4010e2.1
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xb1
jmp 0x40122d
mov dword [esp], ebx
call fcn.00407ab6
test al, al
je case.0x4010e2.1
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xb2
jmp 0x40122d
mov dword [esp], ebx
call fcn.00407ba7
test al, al
je case.0x4010e2.1
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xb3
jmp 0x40122d
mov dword [esp], 0x314
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je case.0x4010e2.1
mov dword [esp + 0x10], 0x204
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
lea eax, [esi + 0x204]
mov dword [esp + 0x10], 0x104
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.004129fb
mov eax, dword [esp + 0x14f0]
mov dword [esi + 0x308], 0
mov byte [esi + 0x310], 1
mov dword [esi + 0x30c], eax
mov dword [esp + 4], esi
mov dword [esp], fcn.0040680d
call fcn.00407f08
mov dword [0x42b330], eax
jmp case.0x4010e2.1
mov dword [0x42b330], 0
jmp case.0x4010e2.1
mov dword [esp], 0x210
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je case.0x4010e2.1
mov dword [esp + 0x10], 0x204
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
lea eax, [esp + 0x4d0]
mov dword [esp + 0x10], 0x1000
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.004129fb
cmp byte [esp + 0x4d0], 0
mov eax, dword [esp + 0x14f0]
mov dword [esi + 0x204], 0
mov byte [esi + 0x20d], 1
mov dword [esi + 0x208], eax
setne byte [esi + 0x20c]
mov dword [esp + 4], esi
mov dword [esp], fcn.0040753d
call fcn.00407f08
mov dword [0x42b32c], eax
jmp case.0x4010e2.1
mov dword [0x42b32c], 0
jmp case.0x4010e2.1
mov dword [esp], 0x414
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je case.0x4010e2.1
mov dword [esp], ebx
mov dword [esp + 0x10], 0x204
or ebp, 0xffffffff
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov edi, esi
mov dword [esp + 4], 7
call fcn.004129fb
lea eax, [esp + 0x4d0]
mov dword [esp], ebx
mov dword [esp + 0x10], 0x1000
mov dword [esp + 8], 2
mov dword [esp + 4], 7
lea ebx, [esp + 0x2cc]
mov dword [esp + 0xc], eax
call fcn.004129fb
lea eax, [esi + 0x204]
mov dword [esi + 0x40c], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_strcpy
xor eax, eax
mov ecx, ebp
repne scasb al, byte es:[edi]
mov edi, esi
not ecx
mov byte [esp + ecx + 0x2ca], 0
mov dword [esp + 4], str..zip
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 8], 0x77
mov dword [esp + 4], 6
mov dword [esp], eax
call fcn.0041e44c
mov ecx, ebp
mov dword [esi + 0x408], eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esi + 0x410], ecx
mov dword [esp + 4], esi
mov dword [esp], fcn.00406f83
jmp 0x401632
mov dword [esp], 8
call sub.msvcrt.dll_malloc
test eax, eax
je case.0x4010e2.1
cmp byte [ebx], 0
mov edx, dword [esp + 0x14f0]
mov dword [eax], edx
setne byte [eax + 4]
mov dword [esp + 4], eax
mov dword [esp], 0x4113b8
call fcn.00407f08
mov dword [0x42b5d0], eax
jmp case.0x4010e2.1
mov dword [0x42b5d0], 0
jmp case.0x4010e2.1
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00411738
jmp case.0x4010e2.1
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.00413748
jmp case.0x4010e2.1
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.0040a4bc
jmp case.0x4010e2.1
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.0040fe8c
jmp case.0x4010e2.1
mov dword [esp], ebx
call fcn.00410193
test al, al
je case.0x4010e2.1
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0xc0
jmp 0x40122d
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.004146e1
jmp case.0x4010e2.1
mov dword [esp], ebx
call fcn.004147fb
jmp case.0x4010e2.1
mov dword [esp], 0x61c
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je case.0x4010e2.1
mov dword [esp + 0x10], 0x204
mov dword [esp + 0xc], eax
lea edi, [esp + 0x4d0]
mov dword [esp + 8], 1
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
lea eax, [esi + 0x204]
mov dword [esp + 0x10], 0x204
mov dword [esp + 8], 2
mov dword [esp + 4], 7
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.004129fb
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], edi
mov dword [esp + 8], 3
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
lea eax, [esi + 0x408]
mov dword [esp + 8], 0x204
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00412d73
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], edi
mov dword [esp + 8], 4
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp], edi
call fcn.00412666
mov dword [esi + 0x610], eax
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], edi
mov dword [esp + 8], 5
mov dword [esp + 4], 7
mov dword [esp], ebx
call fcn.004129fb
mov dword [esp], edi
call fcn.00412666
test eax, eax
mov eax, dword [esp + 0x14f0]
setne byte [esi + 0x60c]
mov dword [esi + 0x618], eax
mov dword [esp + 4], esi
jmp 0x40162b
mov dword [esp], ebx
call fcn.00412666
movzx eax, al
mov dword [esp + 8], eax
mov eax, esi
movzx esi, al
mov eax, dword [esp + 0x14f0]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0040f873
jmp case.0x4010e2.1
mov dword [esp], ebx
call fcn.00412666
movzx eax, al
mov dword [esp + 8], eax
mov eax, esi
movzx esi, al
mov eax, dword [esp + 0x14f0]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0040fd78
jmp case.0x4010e2.1
mov dword [esp], ebx
call fcn.00412666
movzx eax, al
mov dword [esp + 8], eax
mov eax, esi
movzx esi, al
mov eax, dword [esp + 0x14f0]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0040fdcd
jmp case.0x4010e2.1
mov dword [esp], 0xc
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je case.0x4010e2.1
lea eax, [eax + 4]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
add ebx, 4
mov dword [esp], eax
call fcn.00412aa3
lea eax, [esi + 8]
mov dword [esp + 8], 4
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.00412aa3
mov dword [esp + 4], esi
mov dword [esp], 0x411ceb
jmp 0x401632
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.0040262f
jmp case.0x4010e2.1
lea eax, [esp + 0x4d0]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
add ebx, 4
mov dword [esp], eax
call fcn.00412aa3
mov eax, dword [esp + 0x4d0]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.00410ec3
jmp case.0x4010e2.1
lea eax, [esp + 0x8c]
mov dword [esp + 4], ebx
mov dword [esp + 8], 4
add ebx, 4
lea edi, [esp + 0x2cc]
lea esi, [esp + 0x4d0]
mov dword [esp], eax
call fcn.00412aa3
lea eax, [esp + 0x2cc]
mov dword [esp], ebx
mov dword [esp + 0x10], 0x204
mov dword [esp + 8], 1
mov dword [esp + 4], 7
mov dword [esp + 0xc], eax
call fcn.004129fb
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov dword [esp], ebx
lea edi, [esp + 0xcc]
mov dword [esp + 0x10], 0x104
not ecx
mov dword [esp + 8], 2
mov dword [esp + 4], 7
lea eax, [ecx - 1]
mov dword [esp + 0x30], eax
lea eax, [esp + 0xcc]
mov dword [esp + 0xc], eax
call fcn.004129fb
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov dword [esp], ebx
mov dword [esp + 0x10], 0x1000
mov edi, esi
not ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], 3
mov dword [esp + 4], 7
lea ebp, [ecx - 1]
call fcn.004129fb
mov dword [esp], esi
call fcn.00412666
or ecx, 0xffffffff
mov dword [esp + 0x34], eax
xor eax, eax
repne scasb al, byte es:[edi]
add ebp, dword [esp + 0x30]
mov dword [esp], ebx
mov edi, esi
not ecx
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], esi
lea eax, [ecx - 1]
mov dword [esp + 8], 4
mov dword [esp + 4], 7
mov dword [esp + 0x30], ebp
mov dword [esp + 0x38], eax
call fcn.004129fb
mov dword [esp], esi
call fcn.00412666
or ecx, 0xffffffff
mov ebp, eax
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x38]
mov dword [esp], ebx
mov edi, esi
not ecx
mov dword [esp + 0x10], 0x1000
mov dword [esp + 0xc], esi
lea eax, [ecx - 1]
mov dword [esp + 8], 5
mov dword [esp + 4], 7
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x30]
lea eax, [eax + edx + 5]
mov dword [esp + 0x30], eax
call fcn.004129fb
mov dword [esp], esi
call fcn.00412666
or ecx, 0xffffffff
mov edx, eax
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x3c]
add eax, dword [esp + 0x30]
sub ebx, ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], edx
lea eax, [ebx + eax - 2]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xcc]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x2cc]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.00410fc4
jmp case.0x4010e2.1
mov eax, dword [esp + 0x14f0]
mov dword [esp], eax
call fcn.00406084
add esp, 0x14dc
pop ebx
pop esi
pop edi
pop ebp
ret