Function at 0x435870
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x48cf88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x86c
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x38]
mov dword [esp + 0x34], edi
call fcn.0040fec0
xor ebx, ebx
lea ecx, [esp + 0x74]
mov dword [esp + 0x880], ebx
call fcn.00410af0
lea ecx, [esp + 0x30]
mov byte [esp + 0x880], 1
call fcn.00404120
mov byte [esp + 0xf], bl
mov al, byte [esp + 0xf]
mov byte [esp + 0x10], al
xor eax, eax
xor ecx, ecx
mov byte [esp + 0xa0], 0xff
mov dword [esp + 0x70], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov edx, dword [ebp + 8]
mov byte [esp + 0x880], 3
cmp dword [edx + 0x18c], ebx
jne 0x4359fb
cmp dword [ebp + 0x1c], ebx
jle 0x435994
mov esi, dword [ebp + 0xc]
lea ecx, [esp + 0x74]
call fcn.004110f0
sub esp, 0x24
lea edx, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x44], esp
push 0
push edx
push ecx
mov ecx, 0x4a6258
call fcn.0040d180
lea ecx, [esp + 0x98]
call fcn.00410ca0
mov eax, dword [esp + 0xa0]
push esi
lea ecx, [esp + 0x28]
push eax
push ecx
lea edx, [esp + 0x44]
sub esp, 0x10
mov dword [esp + 0x40], 0
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
call fcn.0040c480
lea eax, [esp + 0x90]
mov ecx, edi
push eax
call fcn.00439e90
and eax, 0xffff
jne 0x4359be
mov eax, dword [ebp + 0x1c]
inc ebx
cmp ebx, eax
jl 0x435915
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov byte [esp + 0x880], 2
mov esi, ecx
mov edi, eax
je 0x4359b8
push 0
mov ecx, edi
call fcn.00404010
add edi, 4
cmp edi, esi
jne 0x4359a4
mov eax, dword [esp + 0x14]
push eax
jmp 0x437938
mov ecx, dword [ebp + 0x18]
xor ebx, ebx
cmp ecx, ebx
je 0x4359ca
mov word [ecx], ax
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp edi, esi
mov byte [esp + 0x880], 2
je 0x4361e9
push ebx
mov ecx, edi
call fcn.00404010
add edi, 4
cmp edi, esi
jne 0x4359e2
mov edi, dword [esp + 0x14]
push edi
jmp 0x437a34
lea ecx, [esp + 0x70]
lea eax, [esp + 0xa0]
push ecx
lea ecx, [esp + 0x3c]
push eax
push ecx
push edx
mov ecx, edi
call fcn.00432c60
mov esi, eax
call fcn.0041a470
test al, al
je 0x4361ef
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x4361c2
push 0x49d4b4
push str.debug.txt
call fcn.0047f2e5
mov esi, eax
add esp, 8
cmp esi, ebx
mov dword [esp + 0x6c], esi
je 0x435ffc
push esi
lea edx, [esp + 0xf4]
push 0xff
push edx
call fcn.0047fef5
add esp, 0xc
test eax, eax
je 0x435fef
mov al, byte [esp + 0xf]
push 0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x4c], al
call fcn.004024d0
lea edi, [esp + 0xf0]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x4c]
push ebx
call fcn.00402900
test al, al
je 0x435ad0
mov edi, dword [esp + 0x4c]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0xf0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x6c]
mov dword [esp + 0x50], ebx
mov byte [ebx + eax], 0
mov edi, str.RETURNFRAME
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x880], 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edi, edi
push ecx
push edi
push str.RETURNFRAME
lea ecx, [esp + 0x54]
call fcn.004190f0
cmp eax, dword [0x49014c]
je 0x435fbe
mov cl, byte [esp + 0xf]
mov dword [esp + 0x5c], edi
mov byte [esp + 0x58], cl
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
push edi
push edi
push edi
mov byte [esp + 0x88c], 5
call fcn.004109c0
mov edx, dword [esp + 0x6c]
add esp, 0xc
mov edi, eax
lea ecx, [esp + 0x58]
push edx
push edi
call fcn.00401320
push esi
lea eax, [esp + 0xf4]
push 0xff
push eax
mov dword [esp + 0x6c], edi
call fcn.0047fef5
add esp, 0xc
test eax, eax
je 0x435e56
lea edi, [esp + 0xf0]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
lea ecx, [esp + 0x4c]
push ebx
call fcn.00402900
test al, al
je 0x435ba9
mov edi, dword [esp + 0x4c]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0xf0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x50], ebx
mov byte [ebx + eax], 0
lea ecx, [esp + 0xb4]
call fcn.00404120
push 1
lea ecx, [esp + 0x13]
push 0
push ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0x88c], 6
mov byte [esp + 0x1b], 0x20
call fcn.004190f0
mov esi, eax
mov eax, dword [0x49014c]
cmp esi, eax
je 0x435ca8
mov eax, dword [esp + 0x50]
mov ebx, 1
cmp eax, esi
jae 0x435bf9
call fcn.0047e3c7
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
test edi, edi
je 0x435c3d
mov cl, byte [edi - 1]
test cl, cl
je 0x435c3d
cmp cl, 0xff
je 0x435c3d
push 1
lea ecx, [esp + 0x4c]
mov dword [esp + 0x6c], edi
call fcn.004024d0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x68]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x50]
call fcn.00402840
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
mov ecx, eax
sub ecx, esi
cmp ecx, 1
jae 0x435c4c
mov ebx, ecx
test ebx, ebx
jbe 0x435c82
sub eax, ebx
lea ecx, [ebx + edi]
sub eax, esi
add ecx, esi
add esi, edi
push eax
push ecx
push esi
call fcn.0047ea80
mov esi, dword [esp + 0x5c]
add esp, 0xc
sub esi, ebx
lea ecx, [esp + 0x48]
push 0
push esi
call fcn.00402900
test al, al
je 0x435c82
push esi
lea ecx, [esp + 0x4c]
call fcn.004028e0
push 1
lea eax, [esp + 0x13]
push 0
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x1b], 0x20
call fcn.004190f0
mov esi, eax
mov eax, dword [0x49014c]
cmp esi, eax
jne 0x435be3
push 1
lea ecx, [esp + 0x13]
push 0
push ecx
lea ecx, [esp + 0x54]
mov byte [esp + 0x1b], 0xa
call fcn.004190f0
mov esi, eax
mov eax, dword [0x49014c]
cmp esi, eax
je 0x435d6d
mov eax, dword [esp + 0x50]
mov ebx, 1
cmp eax, esi
jae 0x435ce4
call fcn.0047e3c7
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x4c]
test edi, edi
je 0x435d24
mov cl, byte [edi - 1]
test cl, cl
je 0x435d24
cmp cl, 0xff
je 0x435d24
push 1
lea ecx, [esp + 0x4c]
mov dword [esp + 0x6c], edi
call fcn.004024d0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x68]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x50]
call fcn.00402840
mov eax, dword [esp + 0x50]
mov ecx, eax
sub ecx, esi
cmp ecx, 1
jae 0x435d33
mov ebx, ecx
test ebx, ebx
jbe 0x435d71
mov edx, dword [esp + 0x4c]
sub eax, ebx
sub eax, esi
lea ecx, [ebx + edx]
push eax
add ecx, esi
add esi, edx
push ecx
push esi
call fcn.0047ea80
mov esi, dword [esp + 0x5c]
add esp, 0xc
sub esi, ebx
lea ecx, [esp + 0x48]
push 0
push esi
call fcn.00402900
test al, al
je 0x435d6d
push esi
lea ecx, [esp + 0x4c]
call fcn.004028e0
mov eax, dword [esp + 0x50]
xor ebx, ebx
test eax, 0xfffffffe
mov dword [esp + 0x68], ebx
jbe 0x435e08
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x2c], ecx
mov esi, ecx
cmp eax, ebx
mov edi, 2
jae 0x435d9d
call fcn.0047e3c7
mov eax, dword [esp + 0x50]
sub eax, ebx
cmp eax, 2
jae 0x435daa
mov edi, eax
test edi, edi
jbe 0x435dc9
mov edx, dword [esp + 0x4c]
mov ecx, edi
mov eax, ecx
lea edi, [esp + 0x28]
lea esi, [edx + ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2c]
push esi
lea ecx, [esp + 0x2c]
push str._02x
push ecx
add ebx, 2
call fcn.0047fec1
mov dl, byte [esi]
add esp, 0xc
lea ecx, [esp + 0xb4]
push edx
call fcn.004042b0
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x68]
mov edx, eax
inc ecx
shr edx, 1
inc esi
cmp ecx, edx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x2c], esi
jb 0x435d8b
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0xb4]
push eax
push 1
push ecx
lea ecx, [esp + 0x64]
call fcn.004010c0
lea ecx, [esp + 0xb4]
mov byte [esp + 0x880], 5
call fcn.00404260
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0xf0]
push edx
push 0xff
push eax
call fcn.0047fef5
add esp, 0xc
test eax, eax
jne 0x435b5f
mov ebx, dword [ebp + 0x20]
lea ecx, [esp + 0x58]
push ecx
mov ecx, ebx
call fcn.00410e60
mov edi, dword [esp + 0x34]
mov dl, byte [esp + 0xa0]
mov al, byte [esp + 0x38]
sub esp, 0x10
mov esi, esp
mov byte [edi + 0x1c], dl
lea ecx, [esp + 0x48]
mov dword [esp + 0x30], esp
mov byte [esi], al
call fcn.0045d580
test eax, eax
jge 0x435e91
xor eax, eax
lea ecx, [eax*8]
push ecx
call fcn.0047e9c2
add esp, 4
mov dword [esi + 4], eax
mov edx, dword [esp + 0x50]
mov ecx, esi
push eax
mov eax, dword [esp + 0x50]
push edx
push eax
call fcn.00410950
lea ecx, [edi + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.0040ff20
lea ecx, [esp + 0xcc]
call fcn.0040fec0
mov cl, byte [esp + 0x38]
sub esp, 0x10
mov esi, esp
mov byte [esp + 0x890], 7
mov dword [esp + 0x30], esp
mov byte [esi], cl
lea ecx, [esp + 0x48]
call fcn.0045d580
test eax, eax
jge 0x435ef6
xor eax, eax
lea edx, [eax*8]
push edx
call fcn.0047e9c2
add esp, 4
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x54]
push eax
push ecx
mov ecx, esi
call fcn.00410950
lea ecx, [esp + 0xdc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.0040ff20
mov dl, byte [esp + 0xa0]
sub esp, 0x10
lea eax, [esp + 0xdc]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
mov byte [esp + 0xf0], dl
lea esi, [ebx + 0x10]
call fcn.0040c480
mov ecx, esi
call fcn.0040ff20
mov cl, byte [esp + 0xdc]
mov byte [esp + 0x880], 5
mov byte [esi + 0x10], cl
lea ecx, [esp + 0xcc]
call fcn.0040fee0
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
cmp esi, eax
mov byte [esp + 0x880], 4
mov edi, eax
je 0x435fa3
push 0
mov ecx, esi
call fcn.00404010
add esi, 4
cmp esi, edi
jne 0x435f8f
mov esi, dword [esp + 0x5c]
push esi
call fcn.0047e190
mov esi, dword [esp + 0x70]
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
push 1
lea ecx, [esp + 0x4c]
mov byte [esp + 0x884], 3
call fcn.004024d0
push esi
lea edx, [esp + 0xf4]
push 0xff
push edx
call fcn.0047fef5
add esp, 0xc
test eax, eax
jne 0x435a6f
push esi
xor ebx, ebx
call fcn.0047f1a4
add esp, 4
jmp 0x436069
mov edx, dword [0x4a6778]
mov eax, 0x24
and edx, 0xff
sub eax, edx
mov ecx, eax
lea esi, [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZOffset:]
mov edx, dword [ebp + 0xc]
mov ebx, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x4a6778]
lea edi, [eax + edx]
and ecx, 0xff
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZOffset:
mov eax, ecx
xor edx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov al, byte [0x4a6778]
mov ecx, 0x24
inc al
and eax, 0xff
div ecx
xor ebx, ebx
mov byte [0x4a6778], dl
lea ecx, [esp + 0x24]
call fcn.00404120
mov edx, dword [ebp + 0xc]
push 0x24
push edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x888], 8
call fcn.00404550
mov al, byte [esp + 0xf]
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xbc], al
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
lea ecx, [esp + 0x24]
mov byte [esp + 0x880], 9
push ecx
push 1
push ebx
lea ecx, [esp + 0xc8]
call fcn.004010c0
lea edx, [esp + 0xbc]
lea ecx, [esp + 0x74]
push edx
call fcn.00410e60
cmp dword [ebp + 0x20], ebx
je 0x436155
mov al, byte [esp + 0x74]
sub esp, 0x24
mov edi, esp
mov dword [esp + 0x44], esp
lea ecx, [esp + 0x98]
mov dword [esp + 0x44], edi
mov byte [edi], al
call fcn.00429bd0
cmp eax, ebx
jge 0x436100
xor eax, eax
shl eax, 4
push eax
call fcn.0047e9c2
add esp, 4
mov dword [edi + 4], eax
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0x9c]
push eax
push ecx
push edx
mov ecx, edi
call fcn.0040f5e0
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
lea eax, [esp + 0xa8]
lea ecx, [edi + 0x10]
push eax
mov byte [esp + 0x8a8], 0xa
call fcn.00405830
mov ecx, dword [ebp + 0x20]
mov byte [esp + 0x8a4], 9
call fcn.00410ca0
mov eax, dword [ebp + 0x18]
cmp eax, ebx
je 0x436161
mov word [eax], 0x24
mov esi, dword [esp + 0xc4]
mov edi, dword [esp + 0xc0]
cmp edi, esi
mov byte [esp + 0x880], 8
je 0x436191
push ebx
mov ecx, edi
call fcn.00404010
add edi, 4
cmp edi, esi
jne 0x43617b
mov edi, dword [esp + 0xc0]
push edi
call fcn.0047e190
add esp, 4
lea ecx, [esp + 0x24]
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov byte [esp + 0x880], 3
call fcn.00404260
xor ebx, ebx
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp edi, esi
mov byte [esp + 0x880], 2
je 0x4361e9
push ebx
mov ecx, edi
call fcn.00404010
add edi, 4
cmp edi, esi
jne 0x4361d6
mov edi, dword [esp + 0x14]
push edi
jmp 0x437a34
cmp esi, 1
jne 0x437901
mov dword [esp + 0x70], 0
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
test eax, eax
jle 0x4362c1
lea ecx, [esp + 0x74]
call fcn.004110f0
lea ecx, [esp + 0x38]
call fcn.00410450
mov ecx, dword [edi + 0x60]
mov esi, eax
call fcn.0044b560
cmp eax, 3
je 0x436248
mov ecx, dword [edi + 0x60]
call fcn.0044b560
cmp eax, 9
je 0x436248
mov ecx, dword [edi + 0x60]
call fcn.0044b560
cmp eax, 8
jne 0x436266
cmp si, 1
jle 0x436266
sub esp, 0x24
lea edx, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x44], esp
push edx
push ecx
mov ecx, edi
call fcn.0043c280
jmp 0x436281
sub esp, 0x24
lea ecx, [esp + 0x5c]
mov eax, esp
mov dword [esp + 0x44], esp
push 0
push ecx
push eax
mov ecx, 0x4a6258
call fcn.0040d180
lea ecx, [esp + 0x98]
call fcn.00410ca0
mov ecx, dword [ebp + 8]
call fcn.0044b560
test eax, eax
je 0x436f34
cmp dword [ebp + 0x10], 1
je 0x436f34
lea ecx, [esp + 0x74]
call fcn.004110d0
test ax, ax
jne 0x4362c1
mov eax, dword [ebp + 0x1c]
inc ebx
cmp ebx, eax
jl 0x43620d
lea ecx, [esp + 0x74]
call fcn.004110d0
test ax, ax
je 0x436f67
mov edx, dword [ebp + 0xc]
mov eax, dword [esp + 0xa0]
push edx
lea ecx, [esp + 0x6c]
push eax
push ecx
sub esp, 0x10
lea edx, [esp + 0x54]
mov ecx, esp
mov dword [esp + 0x3c], esp
push edx
mov dword [esp + 0x88], 0
call fcn.0040c480
lea eax, [esp + 0x90]
mov ecx, edi
push eax
call fcn.00439e90
and eax, 0xffff
mov ebx, eax
mov eax, dword [ebp + 0x20]
test eax, eax
mov dword [esp + 0x24], ebx
je 0x4363d7
sub esp, 0x10
mov ebx, eax
lea edx, [esp + 0x94]
mov ecx, esp
mov dword [esp + 0x30], esp
push edx
lea esi, [ebx + 0x10]
call fcn.0040c480
mov ecx, esi
call fcn.0040ff20
mov al, byte [esp + 0x94]
mov ecx, ebx
mov byte [esi + 0x10], al
call fcn.004110f0
mov cl, byte [esp + 0x74]
sub esp, 0x24
mov esi, esp
mov dword [esp + 0x44], esp
mov dword [esp + 0x44], esi
mov byte [esi], cl
lea ecx, [esp + 0x98]
call fcn.00429bd0
test eax, eax
jge 0x43637f
xor eax, eax
shl eax, 4
push eax
call fcn.0047e9c2
add esp, 4
mov dword [esi + 4], eax
mov edx, dword [esp + 0xa0]
mov ecx, esi
push eax
mov eax, dword [esp + 0xa0]
push edx
push eax
call fcn.0040f5e0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea ecx, [esp + 0xa8]
mov byte [esp + 0x8a4], 0xb
push ecx
lea ecx, [esi + 0x10]
call fcn.00405830
mov ecx, ebx
mov byte [esp + 0x8a4], 3
call fcn.00410ca0
mov ebx, dword [esp + 0x24]
mov ecx, dword [edi + 0x60]
call fcn.0044b560
cmp eax, 9
je 0x4363f1
mov ecx, dword [edi + 0x60]
call fcn.0044b560
cmp eax, 8
jne 0x4363fc
cmp dword [esp + 0x68], 1
je 0x436f96
test ebx, ebx
je 0x436fc9
mov dl, byte [esp + 0xa0]
mov al, byte [esp + 0x38]
sub esp, 0x10
mov byte [edi + 0x1c], dl
mov esi, esp
lea ecx, [esp + 0x48]
mov dword [esp + 0x30], esp
mov byte [esi], al
call fcn.0045d580
test eax, eax
jge 0x43642c
xor eax, eax
lea ecx, [eax*8]
push ecx
call fcn.0047e9c2
add esp, 4
mov dword [esi + 4], eax
mov edx, dword [esp + 0x50]
mov ecx, esi
push eax
mov eax, dword [esp + 0x50]
push edx
push eax
call fcn.00410950
lea ecx, [edi + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.0040ff20
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x436469
mov word [eax], bx
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x43799d
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.0044b570
cmp eax, 0xffffffff
jne 0x436493
mov ecx, esi
call fcn.0044b580
cmp eax, 0xffffffff
je 0x43799d
push 0
lea ecx, [esp + 0x78]
call fcn.004110c0
mov esi, eax
lea ecx, [esp + 0x10]
cmp ecx, esi
je 0x4365af
mov edx, dword [esi + 4]
test edx, edx
jne 0x4364b7
xor eax, eax
jmp 0x4364bf
mov eax, dword [esi + 8]
sub eax, edx
sar eax, 2
mov edi, dword [esp + 0x14]
test edi, edi
jne 0x4364cb
xor ecx, ecx
jmp 0x4364d4
mov ecx, dword [esp + 0x18]
sub ecx, edi
sar ecx, 2
cmp eax, ecx
ja 0x43650c
mov eax, dword [esi + 8]
push edi
push eax
push edx
call fcn.004109c0
mov edx, dword [esp + 0x24]
add esp, 0xc
lea ecx, [esp + 0x10]
push edx
push eax
call fcn.00401320
mov ecx, esi
call fcn.00401090
mov ecx, dword [esp + 0x14]
lea edx, [ecx + eax*4]
mov dword [esp + 0x18], edx
jmp 0x4365af
mov ecx, esi
call fcn.00401090
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.004106b0
cmp edi, eax
ja 0x436558
mov edi, dword [esi + 4]
lea ecx, [esp + 0x10]
call fcn.00401090
mov ecx, dword [esp + 0x14]
lea edi, [edi + eax*4]
mov eax, dword [esi + 4]
push ecx
push edi
push eax
call fcn.004109c0
mov edx, dword [esp + 0x24]
mov eax, dword [esi + 8]
add esp, 0xc
lea ecx, [esp + 0x10]
push edx
push eax
push edi
call fcn.00401350
jmp 0x4364f5
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.00401320
mov edx, dword [esp + 0x14]
push edx
call fcn.0047e190
add esp, 4
mov ecx, esi
call fcn.00401090
test eax, eax
jge 0x436585
xor eax, eax
shl eax, 2
push eax
call fcn.0047e9c2
add esp, 4
mov dword [esp + 0x14], eax
mov ecx, dword [esi + 8]
mov esi, dword [esi + 4]
push eax
push ecx
push esi
lea ecx, [esp + 0x1c]
call fcn.00401350
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push 0
lea ecx, [esp + 0x2c]
call fcn.00404150
mov byte [esp + 0x880], 0xc
xor edi, edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x436616
mov ecx, dword [esp + 0x18]
sub ecx, eax
sar ecx, 2
cmp edi, ecx
jae 0x436616
lea ecx, [eax + edi*4]
xor esi, esi
call fcn.00404470
test ax, ax
jle 0x436613
mov edx, dword [esp + 0x14]
push esi
lea ecx, [edx + edi*4]
call fcn.004043e0
push eax
lea ecx, [esp + 0x2c]
call fcn.00404450
mov eax, dword [esp + 0x14]
inc esi
lea ecx, [eax + edi*4]
call fcn.00404470
movsx ecx, ax
cmp esi, ecx
jl 0x4365e8
inc edi
jmp 0x4365c4
lea ecx, [esp + 0x28]
call fcn.00404490
mov ebx, eax
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x436647
lea ecx, [esp + 0x28]
call fcn.00404470
mov edi, dword [ebp + 0xc]
mov esi, ebx
movsx ecx, ax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1f0]
call fcn.00471f30
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xd
mov eax, dword [esi + 0x5c]
push eax
call fcn.0045a230
mov edi, dword [ebp + 8]
lea ecx, [esp + 0xe0]
xor eax, eax
push ecx
mov ecx, edi
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
call fcn.0044b580
push eax
mov ecx, edi
call fcn.0044b570
mov edx, dword [esp + 0x2c]
push eax
push edx
push ebx
lea ecx, [esp + 0x204]
call fcn.00471fa0
mov ecx, dword [esp + 0xe8]
test eax, eax
mov dword [esp + 0x6c], ecx
jne 0x4378b9
test ecx, ecx
jne 0x4366e3
mov ecx, edi
call fcn.0044b530
cmp eax, 0xffffffff
je 0x4370b9
jmp 0x4366ec
cmp ecx, 5
je 0x4367ca
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4366ff
mov ecx, 0x3f
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ebx, dword [ebp + 0x20]
test ebx, ebx
je 0x436711
mov ecx, 9
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x43671d
mov word [eax], 0
mov eax, dword [ebp + 0x24]
test eax, eax
je 0x43672a
mov ecx, dword [esp + 0x6c]
mov dword [eax], ecx
mov ecx, dword [esi + 0x60]
call fcn.0044b560
cmp eax, 9
jne 0x4367ca
test ebx, ebx
je 0x4367ca
mov edi, dword [ebp + 0x20]
mov ecx, edi
call fcn.004110f0
mov dl, byte [esp + 0x74]
sub esp, 0x24
mov esi, esp
mov dword [esp + 0x44], esp
lea ecx, [esp + 0x98]
mov dword [esp + 0x44], esi
mov byte [esi], dl
call fcn.00429bd0
test eax, eax
jge 0x436772
xor eax, eax
shl eax, 4
push eax
call fcn.0047e9c2
add esp, 4
mov dword [esi + 4], eax
mov ecx, dword [esp + 0x9c]
push eax
mov eax, dword [esp + 0xa4]
push eax
push ecx
mov ecx, esi
call fcn.0040f5e0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea edx, [esp + 0xa8]
lea ecx, [esi + 0x10]
push edx
mov byte [esp + 0x8a8], 0xf
call fcn.00405830
mov ecx, edi
mov byte [esp + 0x8a4], 0xd
call fcn.00410ca0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x6c]
dec eax
cmp eax, 4
ja case.default.0x4367d8
jmp dword [eax*4 + 0x437a9c]
push 0
lea ecx, [esp + 0x30]
call fcn.00404150
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 0x12
call fcn.0040fec0
lea ecx, [esp + 0x98]
mov byte [esp + 0x880], 0x13
call fcn.00404120
mov ecx, dword [esi + 0x60]
mov byte [esp + 0x880], 0x14
call fcn.0044b560
cmp eax, 3
je 0x436cbc
cmp eax, 9
je 0x436b0e
cmp eax, 0x28
je 0x436cbc
mov al, byte [esp + 0xf]
test al, al
jne 0x436a6d
lea ecx, [esp + 0x58]
call fcn.00410400
push 0xfe
lea ecx, [esp + 0x5c]
call fcn.004103e0
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00404130
lea ecx, [esp + 0x5c]
call fcn.00410110
lea ecx, [esp + 0x74]
call fcn.004110f0
sub esp, 0x24
lea ecx, [esp + 0x7c]
mov eax, esp
mov dword [esp + 0x44], esp
push 0
push ecx
push eax
mov ecx, 0x4a6258
call fcn.0040d180
lea ecx, [esp + 0x98]
call fcn.00410ca0
lea ecx, [esp + 0x74]
call fcn.004110d0
test ax, ax
je 0x43691e
lea ecx, [esp + 0x98]
mov byte [esp + 0xf], 1
mov byte [esp + 0x880], 0x13
call fcn.00404260
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 0x12
call fcn.0040fee0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x880], 0xd
call fcn.00404260
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov edi, dword [esp + 0x34]
jmp 0x4362d3
lea edx, [esp + 0xbc]
push 0
push edx
lea ecx, [esp + 0x40]
call fcn.004103a0
mov esi, eax
push ecx
mov byte [esp + 0x884], 0x16
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00404130
lea ecx, [esp + 0x9c]
call fcn.004042d0
mov ax, word [esi + 4]
lea ecx, [esp + 0xbc]
mov word [esp + 0x9c], ax
mov byte [esp + 0x880], 0x14
call fcn.00404260
push ecx
lea edx, [esp + 0x9c]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00404130
lea ecx, [esp + 0x30]
call fcn.004042d0
lea ecx, [esp + 0x38]
call fcn.00410400
push 0xfe
lea ecx, [esp + 0x3c]
call fcn.004103e0
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00404130
lea ecx, [esp + 0x3c]
call fcn.00410110
lea ecx, [esp + 0x74]
call fcn.004110f0
sub esp, 0x24
lea edx, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x44], esp
push 0
push edx
push ecx
mov ecx, 0x4a6258
call fcn.0040d180
lea ecx, [esp + 0x98]
call fcn.00410ca0
lea ecx, [esp + 0x74]
call fcn.004110d0
test ax, ax
je 0x4374e4
lea ecx, [esp + 0x98]
mov byte [esp + 0xf], 2
mov byte [esp + 0x880], 0x13
call fcn.00404260
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 0x12
call fcn.0040fee0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x880], 0xd
call fcn.00404260
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov edi, dword [esp + 0x34]
jmp 0x4362d3
lea ecx, [esp + 0x74]
call fcn.004110f0
sub esp, 0x24
mov ecx, 0x4a6258
mov eax, esp
mov dword [esp + 0x44], esp
push 0
push eax
call fcn.0040deb0
lea ecx, [esp + 0x98]
call fcn.00410ca0
lea ecx, [esp + 0x74]
call fcn.004110d0
test ax, ax
jle 0x4374e4
lea ecx, [esp + 0x98]
mov byte [esp + 0x880], 0x13
call fcn.00404260
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 0x12
call fcn.0040fee0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x880], 0xd
call fcn.00404260
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov edi, dword [esp + 0x34]
jmp 0x4362d3
mov ecx, dword [esi + 0x60]
call fcn.0046f550
mov ecx, dword [esi + 0x60]
mov edi, eax
call fcn.0046f5c0
mov ecx, dword [esi + 0x60]
mov ebx, eax
call fcn.0046f5e0
mov esi, eax
mov dword [esp + 0xb8], 0
mov dword [esp + 0xb4], esi
sub esp, 8
fild qword [esp + 0xbc]
lea ecx, [edi + edi]
fstp qword [esp]
push ebx
push ecx
mov ecx, 0x4a6258
call fcn.00408930
lea ecx, [esp + 0x58]
call fcn.00410400
push 0xff
lea ecx, [esp + 0x5c]
call fcn.004103e0
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00404130
lea ecx, [esp + 0x5c]
call fcn.00410110
lea ecx, [esp + 0x74]
call fcn.004110f0
sub esp, 0x24
lea ecx, [esp + 0x7c]
mov eax, esp
mov dword [esp + 0x44], esp
push 0
push ecx
push eax
mov ecx, 0x4a6258
call fcn.0040d180
lea ecx, [esp + 0x98]
call fcn.00410ca0
lea ecx, [esp + 0x74]
call fcn.004110d0
test ax, ax
je 0x436c2d
lea ecx, [esp + 0x98]
mov byte [esp + 0x880], 0x13
call fcn.00404260
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 0x12
call fcn.0040fee0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x880], 0xd
call fcn.00404260
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov edi, dword [esp + 0x34]
jmp 0x4362d3
mov dword [esp + 0x24], 0
cmp dword [esp + 0x24], 5
jge 0x43756c
lea ecx, [esp + 0x58]
call fcn.00410400
push 0xfe
lea ecx, [esp + 0x5c]
call fcn.004103e0
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00404130
lea ecx, [esp + 0x5c]
call fcn.00410110
lea ecx, [esp + 0x74]
call fcn.004110f0
sub esp, 0x24
lea ecx, [esp + 0x7c]
mov eax, esp
mov dword [esp + 0x44], esp
push 0
push ecx
push eax
mov ecx, 0x4a6258
call fcn.0040d180
lea ecx, [esp + 0x98]
call fcn.00410ca0
lea ecx, [esp + 0x74]
call fcn.004110d0
test ax, ax
jne 0x436aaa
inc dword [esp + 0x24]
jmp 0x436c35
mov edi, dword [esp + 0x34]
mov ecx, dword [edi + 0x60]
call fcn.0046f550
mov ecx, dword [edi + 0x60]
mov esi, eax
call fcn.0046f5c0
mov ecx, dword [edi + 0x60]
mov ebx, eax
call fcn.0046f5e0
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], 0
fild qword [esp + 0xa4]
sub esp, 8
lea edx, [esi + esi*4]
mov ecx, 0x4a6258
mov dword [esp + 0x28], eax
fstp qword [esp]
push ebx
push edx
call fcn.00408930
lea ecx, [esp + 0x58]
call fcn.00410400
push 0xff
lea ecx, [esp + 0x5c]
call fcn.004103e0
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00404130
lea ecx, [esp + 0x5c]
call fcn.00410110
lea ecx, [esp + 0x74]
call fcn.004110f0
sub esp, 0x24
lea edx, [esp + 0x7c]
mov ecx, esp
mov dword [esp + 0x48], esp
push 0
push edx
push ecx
mov ecx, 0x4a6258
call fcn.0040d180
lea ecx, [esp + 0x98]
call fcn.00410ca0
lea eax, [esp + 0x48]
push 0
push eax
lea ecx, [esp + 0x40]
call fcn.004103a0
mov edi, eax
push ecx
mov byte [esp + 0x884], 0x15
mov ecx, esp
mov dword [esp + 0x28], esp
push edi
call fcn.00404130
lea ecx, [esp + 0x9c]
call fcn.004042d0
mov cx, word [edi + 4]
mov byte [esp + 0x880], 0x14
mov word [esp + 0x9c], cx
lea ecx, [esp + 0x48]
call fcn.00404260
push ecx
lea edx, [esp + 0x9c]
mov ecx, esp
mov dword [esp + 0x28], esp
push edx
call fcn.00404130
lea ecx, [esp + 0x30]
call fcn.004042d0
lea ecx, [esp + 0x38]
call fcn.00410400
push 0xff
lea ecx, [esp + 0x3c]
call fcn.004103e0
push ecx
mov ecx, esp
lea eax, [esp + 0x30]
mov dword [esp + 0x28], esp
push eax
call fcn.00404130
lea ecx, [esp + 0x3c]
call fcn.00410110
sub esp, 0x24
lea edx, [esp + 0x5c]
mov ecx, esp
mov dword [esp + 0x48], esp
push 0
push edx
push ecx
mov ecx, 0x4a6258
call fcn.0040d180
lea ecx, [esp + 0x98]
call fcn.00410ca0
lea ecx, [esp + 0x74]
call fcn.004110d0
test ax, ax
je 0x437622
lea ecx, [esp + 0x98]
mov byte [esp + 0x880], 0x13
call fcn.00404260
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 0x12
call fcn.0040fee0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x880], 0xd
call fcn.00404260
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov edi, dword [esp + 0x34]
jmp 0x4362d3
mov eax, dword [esp + 0x70]
cmp eax, 4
jge 0x4378b9
mov ecx, dword [esi + 8]
inc eax
mov dword [esp + 0x70], eax
call fcn.004701a0
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov edi, dword [esp + 0x34]
jmp 0x436200
mov eax, dword [esp + 0x70]
cmp eax, 0x7d0
jge 0x4378b9
inc eax
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x70], eax
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov edi, dword [esp + 0x34]
jmp 0x436200
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp edi, esi
mov byte [esp + 0x880], 2
je 0x4370b1
xor ebx, ebx
push ebx
mov ecx, edi
call fcn.00404010
add edi, 4
cmp edi, esi
jne 0x436f4e
mov edi, dword [esp + 0x14]
push edi
jmp 0x437a34
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp edi, esi
mov byte [esp + 0x880], 2
je 0x437004
xor ebx, ebx
push ebx
mov ecx, edi
call fcn.00404010
add edi, 4
cmp edi, esi
jne 0x436f81
mov edi, dword [esp + 0x14]
jmp 0x437006
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp edi, esi
mov byte [esp + 0x880], 2
je 0x4370b1
xor ebx, ebx
push ebx
mov ecx, edi
call fcn.00404010
add edi, 4
cmp edi, esi
jne 0x436fb0
mov edi, dword [esp + 0x14]
push edi
jmp 0x437a34
mov ecx, dword [ebp + 8]
call fcn.0044b050
test eax, eax
jne 0x43706a
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp edi, esi
mov byte [esp + 0x880], 2
je 0x437004
xor ebx, ebx
push ebx
mov ecx, edi
call fcn.00404010
add edi, 4
cmp edi, esi
jne 0x436fef
mov edi, dword [esp + 0x14]
jmp 0x437006
xor ebx, ebx
push edi
call fcn.0047e190
add esp, 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x880], 1
call fcn.00404260
lea ecx, [esp + 0x74]
mov byte [esp + 0x880], 0
call fcn.00410bf0
lea ecx, [esp + 0x38]
mov dword [esp + 0x880], 0xffffffff
call fcn.0040fee0
xor eax, eax
mov ecx, dword [esp + 0x878]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov ecx, dword [ebp + 0x20]
test ecx, ecx
je 0x437076
call fcn.004110f0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x437082
mov word [eax], 0
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp edi, esi
mov byte [esp + 0x880], 2
je 0x4370b1
xor ebx, ebx
push ebx
mov ecx, edi
call fcn.00404010
add edi, 4
cmp edi, esi
jne 0x437098
mov edi, dword [esp + 0x14]
push edi
jmp 0x437a34
xor ebx, ebx
push edi
jmp 0x437a34
mov edi, dword [ebp + 0x20]
test edi, edi
je 0x437144
mov ecx, edi
call fcn.004110f0
mov al, byte [esp + 0x74]
sub esp, 0x24
mov esi, esp
mov dword [esp + 0x44], esp
lea ecx, [esp + 0x98]
mov dword [esp + 0x44], esi
mov byte [esi], al
call fcn.00429bd0
test eax, eax
jge 0x4370f0
xor eax, eax
shl eax, 4
push eax
call fcn.0047e9c2
add esp, 4
mov dword [esi + 4], eax
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0x9c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.0040f5e0
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
lea eax, [esp + 0xa8]
lea ecx, [esi + 0x10]
push eax
mov byte [esp + 0x8a8], 0xe
call fcn.00405830
mov ecx, edi
mov byte [esp + 0x8a4], 0xd
call fcn.00410ca0
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, edi
mov byte [esp + 0x880], 2
je 0x437191
push 0
mov ecx, esi
call fcn.00404010
add esi, 4
cmp esi, edi
jne 0x43717d
mov esi, dword [esp + 0x14]
push esi
call fcn.0047e190
add esp, 4
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
jmp 0x437a48
mov ecx, dword [esp + 0xe4]
xor eax, eax
mov dword [esp + 0x6c], ecx
mov ecx, 0xff
lea edi, [esp + 0x479]
mov byte [esp + 0x478], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x24], 0
cmp eax, 0xffffffff
je 0x437492
lea edx, [esp + 0x478]
lea ecx, [esp + 0x24]
push edx
push ecx
mov ecx, dword [esi + 0x5c]
push eax
call fcn.0042bdb0
push 0
lea ecx, [esp + 0x78]
call fcn.004110c0
mov edi, eax
mov ecx, dword [edi + 4]
mov dl, byte [edi]
test ecx, ecx
mov byte [esp + 0xcc], dl
jne 0x43722c
xor eax, eax
jmp 0x437234
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 2
test eax, eax
jge 0x43723a
xor eax, eax
shl eax, 2
push eax
call fcn.0047e9c2
mov ebx, dword [edi + 8]
mov edi, dword [edi + 4]
add esp, 4
mov esi, eax
cmp edi, ebx
mov dword [esp + 0xd0], eax
mov dword [esp + 0x34], esi
je 0x437275
push edi
push esi
call fcn.00401410
add edi, 4
add esp, 8
add esi, 4
cmp edi, ebx
jne 0x43725d
mov dword [esp + 0x34], esi
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd8], esi
mov cl, byte [esp + 0xf]
xor eax, eax
mov byte [esp + 0xa4], cl
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
push eax
push eax
push eax
mov byte [esp + 0x88c], 0x11
call fcn.004109c0
mov ebx, dword [esp + 0xb8]
mov edi, eax
add esp, 0xc
cmp edi, ebx
mov esi, edi
je 0x4372d7
push 0
mov ecx, esi
call fcn.00404010
add esi, 4
cmp esi, ebx
jne 0x4372c7
mov ebx, dword [esp + 0xd0]
mov eax, dword [esp + 0x34]
cmp ebx, eax
mov dword [esp + 0xac], edi
je 0x437386
mov eax, dword [esp + 0x24]
xor esi, esi
cmp eax, esi
mov dword [esp + 0xb4], esi
jbe 0x437360
mov eax, dword [esp + 0x6c]
lea edx, [esp + 0x478]
sub eax, edx
mov dword [esp + 0x20], eax
mov ecx, ebx
lea edi, [esp + esi + 0x478]
call fcn.00404470
mov ecx, dword [esp + 0x20]
movsx eax, ax
lea edx, [edi + ecx]
cmp edx, eax
ja 0x43734c
mov eax, dword [esp + 0x6c]
mov ecx, ebx
add eax, esi
push eax
call fcn.004043e0
cmp al, byte [edi]
jne 0x437360
mov dword [esp + 0xb4], 1
mov eax, dword [esp + 0x24]
inc esi
cmp esi, eax
jb 0x437313
mov eax, dword [esp + 0xb4]
test eax, eax
jne 0x437377
mov ecx, dword [esp + 0xac]
push ebx
push 1
push ecx
lea ecx, [esp + 0xb0]
call fcn.004010c0
mov eax, dword [esp + 0x34]
add ebx, 4
cmp ebx, eax
jne 0x4372f1
mov edi, dword [ebp + 0x20]
xor ebx, ebx
cmp edi, ebx
je 0x4373be
mov ecx, edi
call fcn.004110f0
mov esi, dword [esp + 0xa8]
cmp esi, ebx
je 0x4373c5
mov edx, dword [esp + 0xac]
sub edx, esi
sar edx, 2
je 0x4373c5
lea eax, [esp + 0xa4]
mov ecx, edi
push eax
call fcn.00410e60
mov esi, dword [esp + 0xa8]
mov edi, dword [esp + 0xac]
mov byte [esp + 0x880], 0x10
cmp esi, edi
je 0x4373ee
push ebx
mov ecx, esi
call fcn.00404010
add esi, 4
cmp esi, edi
jne 0x4373d8
mov esi, dword [esp + 0xa8]
push esi
call fcn.0047e190
mov edi, dword [esp + 0x38]
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov ebx, dword [esp + 0xd4]
add esp, 4
cmp ebx, edi
mov byte [esp + 0x880], 0xd
mov esi, ebx
je 0x437435
push 0
mov ecx, esi
call fcn.00404010
add esi, 4
cmp esi, edi
jne 0x437425
push ebx
call fcn.0047e190
add esp, 4
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, eax
mov byte [esp + 0x880], 2
mov edi, eax
je 0x4379c5
push 0
mov ecx, esi
call fcn.00404010
add esi, 4
cmp esi, edi
jne 0x43747d
jmp 0x4379c1
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, edi
mov byte [esp + 0x880], 2
je 0x437852
push 0
mov ecx, esi
call fcn.00404010
add esi, 4
cmp esi, edi
jne 0x4374cf
jmp 0x43784e
lea ecx, [esp + 0x98]
mov byte [esp + 0x880], 0x13
call fcn.00404260
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 0x12
call fcn.0040fee0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x880], 0xd
call fcn.00404260
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, eax
mov byte [esp + 0x880], 2
mov edi, eax
je 0x437852
mov ecx, esi
call fcn.00404260
add esi, 4
cmp esi, edi
jne 0x437559
jmp 0x43784e
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], 0
fild qword [esp + 0xa4]
sub esp, 8
mov ecx, 0x4a6258
fstp qword [esp]
push ebx
push edi
call fcn.00408930
lea ecx, [esp + 0x98]
mov byte [esp + 0x880], 0x13
call fcn.00404260
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 0x12
call fcn.0040fee0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x880], 0xd
call fcn.00404260
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov byte [esp + 0x880], 2
mov edi, ecx
mov esi, eax
je 0x43761c
mov ecx, esi
call fcn.00404260
add esi, 4
cmp esi, edi
jne 0x43760a
mov eax, dword [esp + 0x14]
push eax
jmp 0x437853
mov ecx, dword [esp + 0x20]
xor edi, edi
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa8], edi
fild qword [esp + 0xa4]
sub esp, 8
mov ecx, 0x4a6258
fstp qword [esp]
push ebx
push esi
call fcn.00408930
lea ecx, [esp + 0x98]
mov byte [esp + 0x880], 0x13
call fcn.00404260
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 0x12
call fcn.0040fee0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x880], 0xd
call fcn.00404260
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov byte [esp + 0x880], 2
mov ebx, ecx
mov esi, eax
je 0x4376d4
mov ecx, esi
call fcn.00404260
add esi, 4
cmp esi, ebx
jne 0x4376c2
mov eax, dword [esp + 0x14]
push eax
call fcn.0047e190
add esp, 4
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
jmp 0x437869
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
cmp dword [esi + 0x2020], 0xffffffff
je 0x437778
mov eax, dword [esi + 0x2018]
xor ebx, ebx
cmp eax, ebx
jne 0x43777a
push ebx
push 1
sub esp, 0x10
mov ecx, 0x4a6710
mov edx, esp
mov dword [esp + 0x38], esp
push 1
push edx
call fcn.00426540
mov ecx, dword [esi + 0x2020]
sub esp, 0x10
mov eax, esp
mov dword [esp + 0x4c], esp
push ecx
push eax
mov ecx, 0x4a6710
mov byte [esp + 0x8b0], 0x17
call fcn.00426540
mov ecx, 0x4a6290
mov byte [esp + 0x8a8], 3
call fcn.00412b80
jmp 0x43777a
xor ebx, ebx
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, edi
mov byte [esp + 0x880], 2
je 0x4377a0
mov ecx, esi
call fcn.00404260
add esi, 4
cmp esi, edi
jne 0x43778e
mov esi, dword [esp + 0x14]
push esi
call fcn.0047e190
add esp, 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x880], 1
call fcn.00404260
lea ecx, [esp + 0x74]
mov byte [esp + 0x880], 0
call fcn.00410bf0
lea ecx, [esp + 0x38]
mov dword [esp + 0x880], 0xffffffff
call fcn.0040fee0
or eax, 0xffffffff
mov ecx, dword [esp + 0x878]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, eax
mov byte [esp + 0x880], 2
mov edi, eax
je 0x437852
mov ecx, esi
call fcn.00404260
add esi, 4
cmp esi, edi
jne 0x437840
mov esi, dword [esp + 0x14]
push esi
call fcn.0047e190
add esp, 4
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x880], 1
call fcn.00404260
lea ecx, [esp + 0x74]
mov byte [esp + 0x880], 0
call fcn.00410bf0
lea ecx, [esp + 0x38]
mov dword [esp + 0x880], 0xffffffff
call fcn.0040fee0
or eax, 0xffffffff
mov ecx, dword [esp + 0x878]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
lea ecx, [esp + 0x74]
call fcn.004110f0
lea edx, [esp + 0x10]
lea ecx, [esp + 0x74]
push edx
call fcn.00410e60
lea ecx, [esp + 0x1f0]
mov byte [esp + 0x880], 0xc
call fcn.00471f90
lea ecx, [esp + 0x28]
mov byte [esp + 0x880], 3
call fcn.00404260
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4379de
mov ecx, dword [ebp + 8]
call fcn.0044b550
test eax, eax
je 0x4379de
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, edi
mov byte [esp + 0x880], 2
je 0x437937
mov ecx, esi
call fcn.00404260
add esi, 4
cmp esi, edi
jne 0x437925
mov esi, dword [esp + 0x14]
push esi
call fcn.0047e190
xor eax, eax
add esp, 4
lea ecx, [esp + 0x30]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x880], 1
call fcn.00404260
lea ecx, [esp + 0x74]
mov byte [esp + 0x880], 0
call fcn.00410bf0
lea ecx, [esp + 0x38]
mov dword [esp + 0x880], 0xffffffff
call fcn.0040fee0
xor eax, eax
mov ecx, dword [esp + 0x878]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
cmp esi, edi
mov byte [esp + 0x880], 2
je 0x4379c5
push 0
mov ecx, esi
call fcn.00404010
add esi, 4
cmp esi, edi
jne 0x4379b1
mov esi, dword [esp + 0x14]
push esi
call fcn.0047e190
add esp, 4
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
jmp 0x437a48
mov esi, dword [esp + 0x14]
xor ebx, ebx
cmp esi, ebx
je 0x437a11
mov eax, dword [esp + 0x18]
sub eax, esi
sar eax, 2
je 0x437a11
mov edi, dword [ebp + 0x20]
cmp edi, ebx
je 0x437a11
mov ecx, edi
call fcn.004110f0
lea ecx, [esp + 0x10]
push ecx
mov ecx, edi
call fcn.00410e60
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov byte [esp + 0x880], 2
cmp esi, edi
je 0x437a33
mov ecx, esi
call fcn.00404260
add esi, 4
cmp esi, edi
jne 0x437a21
mov esi, dword [esp + 0x14]
push esi
call fcn.0047e190
add esp, 4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x30]
mov byte [esp + 0x880], 1
call fcn.00404260
lea ecx, [esp + 0x74]
mov byte [esp + 0x880], 0
call fcn.00410bf0
lea ecx, [esp + 0x38]
mov dword [esp + 0x880], 0xffffffff
call fcn.0040fee0
mov ecx, dword [esp + 0x878]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x20