Function at 0x40e980
Capabilities:
Copy file
Create directory
Read file on windows
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aba30
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x250
mov eax, dword [0x6360c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x248], ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x40f808
lea ecx, [ebp - 0x210]
call fcn.0040a700
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x150]
call fcn.004084c0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x1fc]
cmp ecx, 7
jbe 0x40ea3c
mov edx, dword [ebp - 0x210]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ea32
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f85e
push ecx
push edx
call fcn.0042dc6f
add esp, 8
xor eax, eax
mov dword [ebp - 0x200], 0
lea ecx, [ebp - 0x198]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040a870
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x138]
call fcn.004084c0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x184]
cmp ecx, 7
jbe 0x40eab9
mov edx, dword [ebp - 0x198]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40eaaf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f863
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x140]
xor eax, eax
mov word [ebp - 0x198], ax
mov edi, bind
mov eax, edi
mov dword [ebp - 0x188], 0
sub eax, ecx
mov dword [ebp - 0x184], 7
cmp eax, 0xd
jb 0x40f868
cmp dword [ebp - 0x13c], 7
lea eax, [ebp - 0x150]
push 0xd
cmova eax, dword [ebp - 0x150]
push 0x62a0c0
push ecx
push eax
push ecx
push dword [ebp - 0x244]
lea ecx, [ebp - 0x180]
call fcn.00401b30
mov byte [ebp - 4], 7
mov eax, edi
mov ecx, dword [ebp - 0x128]
sub eax, ecx
cmp eax, 0xd
jb 0x40f868
cmp dword [ebp - 0x124], 7
lea eax, [ebp - 0x138]
push 0xd
cmova eax, dword [ebp - 0x138]
push 0x62a0c0
push ecx
push eax
push ecx
push dword [ebp - 0x244]
lea ecx, [ebp - 0x168]
call fcn.00401b30
mov byte [ebp - 4], 8
mov eax, edi
mov ecx, dword [ebp - 0x128]
sub eax, ecx
cmp eax, 0xa
jb 0x40f868
cmp dword [ebp - 0x124], 7
lea eax, [ebp - 0x138]
push 0xa
cmova eax, dword [ebp - 0x138]
push str.ybpath.tmp
push ecx
push eax
push ecx
push dword [ebp - 0x244]
lea ecx, [ebp - 0x240]
call fcn.00401b30
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x180]
cmp dword [ebp - 0x16c], 7
lea edx, [ebp - 0x168]
mov esi, dword [ebp - 0x158]
cmova ecx, dword [ebp - 0x180]
cmp dword [ebp - 0x154], 7
cmova edx, dword [ebp - 0x168]
cmp esi, dword [ebp - 0x170]
jne 0x40ec6c
test esi, esi
je 0x40ec03
nop dword [eax + eax]
mov ax, word [edx]
cmp ax, word [ecx]
jne 0x40ec6c
add edx, 2
add ecx, 2
sub esi, 1
jne 0x40ebf0
push 0x62a0f8
push str..ybpath.tmp
call fcn.0047fe6f
mov esi, eax
add esp, 8
test esi, esi
je 0x40f1e2
push 0x105
lea eax, [ebp - 0x120]
push 0
push eax
call fcn.00477510
add esp, 0xc
lea eax, [ebp - 0x120]
push esi
push 1
push 0x104
push eax
call fcn.004804b3
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x120]
add esp, 0x10
push eax
call fcn.00403fd0
push esi
call fcn.0047ffab
add esp, 4
jmp 0x40f654
mov ecx, dword [ebp - 0x128]
mov eax, edi
sub eax, ecx
cmp eax, 6
jb 0x40f868
cmp dword [ebp - 0x124], 7
lea eax, [ebp - 0x138]
push 6
cmova eax, dword [ebp - 0x138]
push str.config
push ecx
push eax
push ecx
push dword [ebp - 0x244]
lea ecx, [ebp - 0x210]
call fcn.00401b30
mov byte [ebp - 4], 0xa
mov eax, edi
mov ecx, dword [ebp - 0x128]
sub eax, ecx
cmp eax, 0x11
jb 0x40f868
cmp dword [ebp - 0x124], 7
lea eax, [ebp - 0x138]
push 0x11
cmova eax, dword [ebp - 0x138]
push str.configcache.json
push ecx
push eax
push ecx
push dword [ebp - 0x244]
lea ecx, [ebp - 0x1f8]
call fcn.00401b30
mov byte [ebp - 4], 0xb
mov eax, edi
mov ecx, dword [ebp - 0x128]
sub eax, ecx
cmp eax, 0x12
jb 0x40f868
cmp dword [ebp - 0x124], 7
lea eax, [ebp - 0x138]
push 0x12
cmova eax, dword [ebp - 0x138]
push str.configclient.json
push ecx
push eax
push ecx
push dword [ebp - 0x244]
lea ecx, [ebp - 0x1e0]
call fcn.00401b30
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x210]
cmp dword [ebp - 0x1fc], 7
push 0
cmova eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0x140]
mov eax, edi
sub eax, ecx
cmp eax, 0x11
jb 0x40f868
cmp dword [ebp - 0x13c], 7
lea eax, [ebp - 0x150]
push 0x11
cmova eax, dword [ebp - 0x150]
push str.configcache.json
push ecx
push eax
push ecx
push dword [ebp - 0x244]
lea ecx, [ebp - 0x1c8]
call fcn.00401b30
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x140]
sub edi, ecx
cmp edi, 0x12
jb 0x40f868
cmp dword [ebp - 0x13c], 7
lea eax, [ebp - 0x150]
push 0x12
cmova eax, dword [ebp - 0x150]
push str.configclient.json
push ecx
push eax
push ecx
push dword [ebp - 0x244]
lea ecx, [ebp - 0x1b0]
call fcn.00401b30
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1f8]
cmp dword [ebp - 0x1e4], 7
lea eax, [ebp - 0x1c8]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
cmova ecx, dword [ebp - 0x1f8]
cmp dword [ebp - 0x1b4], 7
push 0
cmova eax, dword [ebp - 0x1c8]
push ecx
push eax
call esi
cmp dword [ebp - 0x1cc], 7
lea ecx, [ebp - 0x1e0]
push 0
cmova ecx, dword [ebp - 0x1e0]
lea eax, [ebp - 0x1b0]
cmp dword [ebp - 0x19c], 7
push ecx
cmova eax, dword [ebp - 0x1b0]
push eax
call esi
sub esp, 0x18
lea eax, [ebp - 0x138]
mov ecx, esp
mov dword [ebp - 0x244], esp
push eax
call fcn.00403ed0
sub esp, 0x18
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x150]
mov ecx, esp
push eax
call fcn.00403ed0
mov byte [ebp - 4], 0xe
call fcn.0040f890
push 0x62a0f4
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x260]
call fcn.00403ed0
push 0
push 0
push 0
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x260]
cmp dword [ebp - 0x24c], 7
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmova eax, dword [ebp - 0x260]
push 0
push dword [ebp - 0x250]
push eax
push 0
push 0
call edi
mov esi, eax
lea ecx, [esi + 1]
push ecx
call fcn.0042def0
add esp, 4
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x24c], 7
lea ecx, [ebp - 0x260]
cmova ecx, dword [ebp - 0x260]
push 0
push 0
push esi
push eax
push dword [ebp - 0x250]
push ecx
push 0
push 0
call edi
mov edi, dword [ebp - 0x248]
xorps xmm0, xmm0
mov ecx, edi
mov byte [edi + esi], 0
movups xmmword [ebp - 0x228], xmm0
mov dword [ebp - 0x218], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x214], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40ef30
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x228]
call fcn.00406eb0
push 1
push edi
call fcn.0042dc6f
mov byte [ebp - 4], 0xe
add esp, 8
mov ecx, dword [ebp - 0x24c]
cmp ecx, 7
jbe 0x40ef95
mov edx, dword [ebp - 0x260]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40ef8b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f86d
push ecx
push edx
call fcn.0042dc6f
add esp, 8
xor eax, eax
mov dword [ebp - 0x250], 0
cmp dword [ebp - 0x214], 0xf
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x228]
cmova eax, dword [ebp - 0x228]
push eax
mov dword [ebp - 0x24c], 7
call fcn.0047fe6f
mov ecx, dword [ebp - 0x214]
add esp, 8
mov esi, eax
cmp ecx, 0xf
jbe 0x40f00b
mov edx, dword [ebp - 0x228]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40f001
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f86d
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0xf
mov byte [ebp - 0x228], 0
test esi, esi
jne 0x40f37c
mov ecx, dword [ebp - 0x19c]
cmp ecx, 7
jbe 0x40f06e
mov edx, dword [ebp - 0x1b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f064
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x1b4]
xor eax, eax
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 7
mov word [ebp - 0x1b0], ax
cmp ecx, 7
jbe 0x40f0cb
mov edx, dword [ebp - 0x1c8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f0c1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x1cc]
xor eax, eax
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 7
mov word [ebp - 0x1c8], ax
cmp ecx, 7
jbe 0x40f128
mov edx, dword [ebp - 0x1e0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f11e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x1e4]
xor eax, eax
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 7
mov word [ebp - 0x1e0], ax
cmp ecx, 7
jbe 0x40f185
mov edx, dword [ebp - 0x1f8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f17b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
cmp ecx, 7
jbe 0x40f1e2
mov edx, dword [ebp - 0x210]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f1d8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x22c]
cmp ecx, 7
jbe 0x40f222
mov edx, dword [ebp - 0x240]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f218
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f872
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x154]
cmp ecx, 7
jbe 0x40f262
mov edx, dword [ebp - 0x168]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f258
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f872
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x16c]
xor eax, eax
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 7
mov word [ebp - 0x168], ax
cmp ecx, 7
jbe 0x40f2bf
mov edx, dword [ebp - 0x180]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f2b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f872
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x124]
xor eax, eax
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
cmp ecx, 7
jbe 0x40f31c
mov edx, dword [ebp - 0x138]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f312
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f872
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x13c]
xor eax, eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 7
mov word [ebp - 0x138], ax
cmp ecx, 7
jbe 0x40f7eb
mov edx, dword [ebp - 0x150]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f7e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f872
jmp 0x40f7e1
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x198]
call fcn.00403ed0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x198]
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x184], 7
push esi
cmova ecx, dword [ebp - 0x198]
push 1
lea eax, [eax*2 + 2]
push eax
push ecx
call fcn.004802a0
push esi
call fcn.0047ffab
add esp, 0x14
lea ecx, [ebp - 0x168]
cmp dword [ebp - 0x154], 7
lea eax, [ebp - 0x180]
cmova ecx, dword [ebp - 0x168]
cmp dword [ebp - 0x16c], 7
push 0
cmova eax, dword [ebp - 0x180]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x40f443
sub esp, 0x18
lea eax, [ebx + 8]
mov ecx, esp
mov dword [ebp - 0x244], esp
push eax
call fcn.00403ed0
sub esp, 0x18
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x168]
mov ecx, esp
push eax
call fcn.00403ed0
xor ecx, ecx
mov byte [ebp - 4], 0x11
call fcn.00401250
add esp, 0x30
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x184]
cmp ecx, 7
jbe 0x40f483
mov edx, dword [ebp - 0x198]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f479
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x19c]
xor eax, eax
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x184], 7
mov word [ebp - 0x198], ax
cmp ecx, 7
jbe 0x40f4e0
mov edx, dword [ebp - 0x1b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f4d6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x1b4]
xor eax, eax
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x19c], 7
mov word [ebp - 0x1b0], ax
cmp ecx, 7
jbe 0x40f53d
mov edx, dword [ebp - 0x1c8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f533
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x1cc]
xor eax, eax
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x1b4], 7
mov word [ebp - 0x1c8], ax
cmp ecx, 7
jbe 0x40f59a
mov edx, dword [ebp - 0x1e0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f590
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x1e4]
xor eax, eax
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 7
mov word [ebp - 0x1e0], ax
cmp ecx, 7
jbe 0x40f5f7
mov edx, dword [ebp - 0x1f8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f5ed
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
cmp ecx, 7
jbe 0x40f654
mov edx, dword [ebp - 0x210]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f64a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f877
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x22c]
cmp ecx, 7
jbe 0x40f694
mov edx, dword [ebp - 0x240]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f68a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f87c
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x154]
cmp ecx, 7
jbe 0x40f6d4
mov edx, dword [ebp - 0x168]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f6ca
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f87c
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x16c]
xor eax, eax
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 7
mov word [ebp - 0x168], ax
cmp ecx, 7
jbe 0x40f731
mov edx, dword [ebp - 0x180]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f727
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f87c
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x124]
xor eax, eax
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 7
mov word [ebp - 0x180], ax
cmp ecx, 7
jbe 0x40f78e
mov edx, dword [ebp - 0x138]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f784
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f87c
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0x13c]
xor eax, eax
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 7
mov word [ebp - 0x138], ax
cmp ecx, 7
jbe 0x40f7eb
mov edx, dword [ebp - 0x150]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f7e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f87c
push ecx
push edx
call fcn.0042dc6f
add esp, 8
xor eax, eax
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 7
mov word [ebp - 0x150], ax
mov ecx, dword [ebx + 0x1c]
cmp ecx, 7
jbe 0x40f83e
mov edx, dword [ebx + 8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40f834
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40f87c
push ecx
push edx
call fcn.0042dc6f
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042d9e0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
call fcn.0047a870
call fcn.0047a870
call fcn.00401210
call fcn.0047a870
call fcn.0047a870
call fcn.0047a870
call fcn.0047a870
int3