Function at 0x409b80
Capabilities:
Allocate or change rwx memory
Check os version
Execute shellcode via indirect call
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4192d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
or ebp, 0xffffffff
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], ebp
call sub.MFC42.DLL_CString::CString
push edi
push str.KOEI_SAN9WINDOW
mov dword [esp + 0x40], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], edi
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
jne 0x409bfd
mov dword [esi + 0x6c], edi
mov dword [esi + 0x68], edi
push 0x4280a0
lea ecx, [esi + 0x1d3c]
mov dword [esi + 0x84], edi
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov dword [esp + 0x38], ebp
jmp 0x413987
mov ecx, dword [esi + 0x68]
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp ecx, eax
je 0x411b6a
mov edx, dword [esi + 0x84]
inc edx
mov ecx, edx
mov dword [esi + 0x84], edx
cmp ecx, 5
jg 0x409c2b
mov dword [esp + 0x38], ebp
jmp 0x413987
xor ecx, ecx
lea ebx, [esi + 0x70]
mov dword [esi + 0x84], ecx
push ebx
mov dword [esi + 0x8c], ecx
push eax
mov dword [esi + 0x68], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebx]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
mov dword [esi + 0x6c], eax
jne 0x409c77
push 0x428090
lea ecx, [esi + 0x1d3c]
mov dword [esi + 0x68], eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov dword [esp + 0x38], ebp
jmp 0x413987
mov ecx, esi
call fcn.004091f0
test al, al
jne 0x409cad
xor edi, edi
mov dword [esi + 0x68], edi
mov ecx, dword [esi + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x428078
lea ecx, [esi + 0x1d3c]
mov dword [esi + 0x6c], edi
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov dword [esp + 0x38], ebp
jmp 0x413987
mov eax, dword [esi + 0x1d28]
mov ecx, dword [esi + 0x1d10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 0x6c]
push 0x40
push eax
push ecx
push edx
call ebx
test eax, eax
jne 0x409cdf
mov dword [esp + 0x10], 0x258
jmp 0x413888
mov ecx, dword [esi + 0x1d28]
mov edx, dword [esi + 0x1d14]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x6c]
push 4
push ecx
push edx
push eax
call ebx
test eax, eax
jne 0x409d0b
mov dword [esp + 0x10], 0x259
jmp 0x413888
mov edx, dword [esi + 0x1d28]
mov eax, dword [esi + 0x1d18]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esi + 0x6c]
push 4
push edx
push eax
push ecx
call ebx
test eax, eax
jne 0x409d37
mov dword [esp + 0x10], 0x25d
jmp 0x413888
mov eax, dword [esi + 0x1d28]
mov ecx, dword [esi + 0x1d24]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 0x6c]
push 0x40
push eax
push ecx
push edx
call ebx
test eax, eax
jne 0x409d63
mov dword [esp + 0x10], 0x25c
jmp 0x413888
mov eax, dword [esi + 0x1d2c]
mov ecx, dword [0x41e688]
imul eax, dword [esi + 0x1d28]
mov edx, dword [esi + 0x6c]
push 0x40
push 0x1000
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x20], eax
jne 0x409da2
mov dword [esp + 0x10], 0x262
jmp 0x413888
mov dword [esi + 0x80], 0
mov ebx, 0x4288d8
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x409dfc
add ebx, 0xc
cmp ebx, 0x4288f0
jl 0x409db1
mov ebx, 0x428ce0
mov ecx, dword [ebx - 4]
mov edx, dword [ebx]
mov eax, dword [ebx - 8]
push 0
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x409e09
add ebx, 0xc
cmp ebx, 0x428d04
jl 0x409dd8
jmp 0x409e16
mov dword [esp + 0x10], 0x13
jmp 0x413888
mov dword [esp + 0x10], 0x23
jmp 0x413888
mov ebx, 0x428938
mov edx, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx - 8]
push 0
push edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x409e66
add ebx, 0xc
cmp ebx, 0x428968
jl 0x409e1b
mov ebx, 0x428d08
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x409e73
add ebx, 0xc
cmp ebx, 0x428d2c
jl 0x409e42
jmp 0x409e80
mov dword [esp + 0x10], 0x17
jmp 0x413888
mov dword [esp + 0x10], 0x2c
jmp 0x413888
mov ecx, dword [0x41ff70]
mov edx, dword [esi + 0x6c]
push 0
push 0xf
push 0x41ff74
push ecx
push edx
call edi
test eax, eax
jne 0x409ea7
mov dword [esp + 0x10], 0x18
jmp 0x413888
mov ebx, 0x4289d0
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x409ef7
add ebx, 0xc
cmp ebx, 0x4289e8
jl 0x409eac
mov ebx, 0x428d98
mov ecx, dword [ebx - 4]
mov edx, dword [ebx]
mov eax, dword [ebx - 8]
push 0
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x409f04
add ebx, 0xc
cmp ebx, 0x428db0
jl 0x409ed3
jmp 0x409f11
mov dword [esp + 0x10], 0x1e
jmp 0x413888
mov dword [esp + 0x10], 0x1a
jmp 0x413888
mov ebx, 0x428808
mov edx, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx - 8]
push 0
push edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x409f61
add ebx, 0xc
cmp ebx, 0x428820
jl 0x409f16
mov ebx, 0x428968
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x409f6e
add ebx, 0xc
cmp ebx, 0x42898c
jl 0x409f3d
jmp 0x409f7b
mov dword [esp + 0x10], 0xa
jmp 0x413888
mov dword [esp + 0x10], 0x1b
jmp 0x413888
mov ebx, 0x4288c8
mov ecx, dword [ebx - 4]
mov edx, dword [ebx]
mov eax, dword [ebx - 8]
push 0
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x409fcb
add ebx, 0xc
cmp ebx, 0x4288d4
jl 0x409f80
mov ebx, 0x4289b8
mov edx, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx - 8]
push 0
push edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x409fd8
add ebx, 0xc
cmp ebx, 0x4289d0
jl 0x409fa7
jmp 0x409fe5
mov dword [esp + 0x10], 0x10
jmp 0x413888
mov dword [esp + 0x10], 0x25
jmp 0x413888
mov ebx, 0x428d30
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x40a035
add ebx, 0xc
cmp ebx, 0x428d54
jl 0x409fea
mov ebx, 0x428820
mov ecx, dword [ebx - 4]
mov edx, dword [ebx]
mov eax, dword [ebx - 8]
push 0
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x40a042
add ebx, 0xc
cmp ebx, 0x42882c
jl 0x40a011
jmp 0x40a04f
mov dword [esp + 0x10], 0x2e
jmp 0x413888
mov dword [esp + 0x10], 0xb
jmp 0x413888
mov ebx, 0x428cc8
mov edx, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx - 8]
push 0
push edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x40a09c
add ebx, 0xc
cmp ebx, 0x428ce0
jl 0x40a054
mov eax, dword [0x41fe98]
mov ecx, dword [esi + 0x6c]
push 0
push 0xe
push 0x41fe9c
push eax
push ecx
call edi
test eax, eax
jne 0x40a0a9
mov dword [esp + 0x10], 0x1d
jmp 0x413888
mov dword [esp + 0x10], 0x21
jmp 0x413888
mov ebx, 0x428830
mov edx, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx - 8]
push 0
push edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x40a0f9
add ebx, 0xc
cmp ebx, 0x428854
jl 0x40a0ae
mov ebx, 0x428858
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x40a106
add ebx, 0xc
cmp ebx, 0x428894
jl 0x40a0d5
jmp 0x40a113
mov dword [esp + 0x10], 0xc
jmp 0x413888
mov dword [esp + 0x10], 0xd
jmp 0x413888
mov ecx, dword [0x41eb60]
mov edx, dword [esi + 0x6c]
push 0
push 9
push 0x41eb64
push ecx
push edx
call edi
test eax, eax
jne 0x40a13a
mov dword [esp + 0x10], 0x26
jmp 0x413888
mov ebx, 0x428908
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x40a18a
add ebx, 0xc
cmp ebx, 0x428920
jl 0x40a13f
mov ebx, 0x428d80
mov ecx, dword [ebx - 4]
mov edx, dword [ebx]
mov eax, dword [ebx - 8]
push 0
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x40a197
add ebx, 0xc
cmp ebx, 0x428d98
jl 0x40a166
jmp 0x40a1a4
mov dword [esp + 0x10], 0x15
jmp 0x413888
mov dword [esp + 0x10], 0x30
jmp 0x413888
mov ebx, 0x428898
mov edx, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx - 8]
push 0
push edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x40a1f4
add ebx, 0xc
cmp ebx, 0x4288a4
jl 0x40a1a9
mov ebx, 0x428990
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x40a201
add ebx, 0xc
cmp ebx, 0x4289b4
jl 0x40a1d0
jmp 0x40a20e
mov dword [esp + 0x10], 0xf
jmp 0x413888
mov dword [esp + 0x10], 0x1c
jmp 0x413888
mov ebx, 0x4288a8
mov ecx, dword [ebx - 4]
mov edx, dword [ebx]
mov eax, dword [ebx - 8]
push 0
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x40a25e
add ebx, 0xc
cmp ebx, 0x4288b4
jl 0x40a213
mov ebx, 0x428d58
mov edx, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx - 8]
push 0
push edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x40a26b
add ebx, 0xc
cmp ebx, 0x428d7c
jl 0x40a23a
jmp 0x40a278
mov dword [esp + 0x10], 0x11
jmp 0x413888
mov dword [esp + 0x10], 0x2f
jmp 0x413888
mov ebx, 0x4288b8
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x40a2c8
add ebx, 0xc
cmp ebx, 0x4288c4
jl 0x40a27d
mov ebx, 0x428db0
mov ecx, dword [ebx - 4]
mov edx, dword [ebx]
mov eax, dword [ebx - 8]
push 0
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x40a2d5
add ebx, 0xc
cmp ebx, 0x428dc8
jl 0x40a2a4
jmp 0x40a2e2
mov dword [esp + 0x10], 0x12
jmp 0x413888
mov dword [esp + 0x10], 3
jmp 0x413888
mov ebx, 0x428920
mov edx, dword [ebx - 4]
mov eax, dword [ebx]
mov ecx, dword [ebx - 8]
push 0
push edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x40a332
add ebx, 0xc
cmp ebx, 0x428938
jl 0x40a2e7
mov ebx, 0x4288f0
mov eax, dword [ebx - 4]
mov ecx, dword [ebx]
mov edx, dword [ebx - 8]
push 0
push eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x40a33f
add ebx, 0xc
cmp ebx, 0x428908
jl 0x40a30e
jmp 0x40a34c
mov dword [esp + 0x10], 0x16
jmp 0x413888
mov dword [esp + 0x10], 0x14
jmp 0x413888
mov ecx, dword [0x41fe28]
mov edx, dword [esi + 0x6c]
push 0
push 8
push 0x41fe2c
push ecx
push edx
call edi
test eax, eax
jne 0x40a373
mov dword [esp + 0x10], 0x19
jmp 0x413888
mov eax, dword [0x41fe60]
mov ecx, dword [esi + 0x6c]
push 0
push 9
push 0x41fe64
push eax
push ecx
call edi
test eax, eax
jne 0x40a399
mov dword [esp + 0x10], 4
jmp 0x413888
mov edx, dword [0x420e98]
mov eax, dword [esi + 0x6c]
push 0
push 9
push 0x420e9c
push edx
push eax
call edi
test eax, eax
jne 0x40a3c0
mov dword [esp + 0x10], 0xe
jmp 0x413888
mov ecx, dword [0x421840]
mov edx, dword [esi + 0x6c]
push 0
push 0xe
push 0x421844
push ecx
push edx
call edi
test eax, eax
jne 0x40a3e7
mov dword [esp + 0x10], 0x22
jmp 0x413888
mov eax, dword [0x4226d8]
mov ecx, dword [esi + 0x6c]
push 0
push 0xb
push 0x4226dc
push eax
push ecx
call edi
test eax, eax
jne 0x40a40d
mov dword [esp + 0x10], 0x24
jmp 0x413888
mov edx, dword [0x422f10]
mov eax, dword [esi + 0x6c]
push 0
push 0xf
push 0x422f14
push edx
push eax
call edi
test eax, eax
jne 0x40a434
mov dword [esp + 0x10], 0x2b
jmp 0x413888
mov ecx, dword [0x4232a8]
mov edx, dword [esi + 0x6c]
push 0
push 0xf
push 0x4232ac
push ecx
push edx
call edi
test eax, eax
jne 0x40a45b
mov dword [esp + 0x10], 0x34
jmp 0x413888
mov eax, dword [0x423660]
mov ecx, dword [esi + 0x6c]
push 0
push 0xc
push 0x423664
push eax
push ecx
call edi
test eax, eax
jne 0x40a481
mov dword [esp + 0x10], 0x35
jmp 0x413888
mov edx, dword [0x421c80]
mov eax, dword [esi + 0x6c]
push 0
push 0xb
push 0x421c84
push edx
push eax
call edi
test eax, eax
jne 0x40a4a8
mov dword [esp + 0x10], 0x36
jmp 0x413888
mov ecx, dword [0x424768]
mov edx, dword [esi + 0x6c]
push 0
push 0xf
push 0x42476c
push ecx
push edx
call edi
test eax, eax
jne 0x40a4cf
mov dword [esp + 0x10], 0x2d
jmp 0x413888
mov eax, dword [0x424a40]
mov ecx, dword [esi + 0x6c]
push 0
push 4
push 0x424a44
push eax
push ecx
call edi
test eax, eax
jne 0x40a4f5
mov dword [esp + 0x10], 0x31
jmp 0x413888
mov edx, dword [0x41e610]
mov eax, dword [esi + 0x6c]
push 0
push 9
push 0x41e614
push edx
push eax
call edi
test eax, eax
jne 0x40a51c
mov dword [esp + 0x10], 0x37
jmp 0x413888
mov ecx, dword [0x41e648]
mov edx, dword [esi + 0x6c]
push 0
push 0xd
push 0x41e64c
push ecx
push edx
call edi
test eax, eax
jne 0x40a543
mov dword [esp + 0x10], 0x38
jmp 0x413888
mov eax, dword [0x4287c4]
mov ecx, dword [esi + 0x6c]
push 0
push 0x20
push 0x41e7f4
push eax
push ecx
call edi
test eax, eax
jne 0x40a569
mov dword [esp + 0x10], 0x277
jmp 0x413888
mov edx, dword [0x4287c0]
mov eax, dword [esi + 0x6c]
push 0
push 0x20
push 0x41e814
push edx
push eax
call edi
test eax, eax
jne 0x40a590
mov dword [esp + 0x10], 0x2fe
jmp 0x413888
mov ecx, dword [0x4285e0]
mov edx, dword [esi + 0x6c]
push 0
push 0x18
push 0x422bbc
push ecx
push edx
call edi
test eax, eax
jne 0x40a5b7
mov dword [esp + 0x10], 0x328
jmp 0x413888
mov eax, dword [esi + 0x1d38]
mov ecx, dword [esi + 0x6c]
push 0
push 0x4d
push 0x41ad60
push eax
push ecx
call edi
test eax, eax
jne 0x40a5de
mov dword [esp + 0x10], 0x1c2
jmp 0x413888
mov edx, dword [esi + 0x143c]
mov eax, dword [esi + 0x6c]
push 0
push 0xc
push 0x427ff8
push edx
push eax
call edi
test eax, eax
jne 0x40a605
mov dword [esp + 0x10], 0x1e0
jmp 0x413888
mov ecx, dword [0x41e0ac]
mov edx, dword [esi + 0x6c]
push 0
push 8
push 0x41e0b0
push ecx
push edx
call edi
test eax, eax
jne 0x40a62c
mov dword [esp + 0x10], 0x1e1
jmp 0x413888
mov eax, dword [0x4287d0]
mov ecx, dword [esi + 0x6c]
push 0
push 0x39
push 0x41e68c
push eax
push ecx
call edi
test eax, eax
jne 0x40a652
mov dword [esp + 0x10], 0x265
jmp 0x413888
mov edx, dword [0x4287b8]
mov eax, dword [esi + 0x6c]
push 0
push 0x86
push 0x41e84c
push edx
push eax
call edi
test eax, eax
jne 0x40a67c
mov dword [esp + 0x10], 0x279
jmp 0x413888
mov ecx, dword [0x4287b4]
mov edx, dword [esi + 0x6c]
push 0
push 0xf4
push 0x41e900
push ecx
push edx
call edi
test eax, eax
jne 0x40a6a6
mov dword [esp + 0x10], 0x448
jmp 0x413888
mov eax, dword [0x428788]
mov ecx, dword [esi + 0x6c]
push 0
push 0x8f
push 0x41f258
push eax
push ecx
call edi
test eax, eax
jne 0x40a6cf
mov dword [esp + 0x10], 0x289
jmp 0x413888
mov edx, dword [0x42876c]
mov eax, dword [esi + 0x6c]
push 0
push 0x2d9
push 0x41f8a0
push edx
push eax
call edi
test eax, eax
jne 0x40a6f9
mov dword [esp + 0x10], 0x297
jmp 0x413888
mov ecx, dword [0x428758]
mov edx, dword [esi + 0x6c]
push 0
push 0x6a
push 0x41fed8
push ecx
push edx
call edi
test eax, eax
jne 0x40a720
mov dword [esp + 0x10], 0x29d
jmp 0x413888
mov eax, dword [0x42874c]
mov ecx, dword [esi + 0x6c]
push 0
push 0x52
push 0x420108
push eax
push ecx
call edi
test eax, eax
jne 0x40a746
mov dword [esp + 0x10], 0x29f
jmp 0x413888
mov edx, dword [0x428738]
mov eax, dword [esi + 0x6c]
push 0
push 0x2f
push 0x420440
push edx
push eax
call edi
test eax, eax
jne 0x40a76d
mov dword [esp + 0x10], 0x2a7
jmp 0x413888
mov ecx, dword [0x428728]
mov edx, dword [esi + 0x6c]
push 0
push 0x85
push 0x420584
push ecx
push edx
call edi
test eax, eax
jne 0x40a797
mov dword [esp + 0x10], 0x2af
jmp 0x413888
mov eax, dword [0x428718]
mov ecx, dword [esi + 0x6c]
push 0
push 0x3f
push 0x420840
push eax
push ecx
call edi
test eax, eax
jne 0x40a7bd
mov dword [esp + 0x10], 0x2b4
jmp 0x413888
mov edx, dword [0x42870c]
mov eax, dword [esi + 0x6c]
push 0
push 0x26
push 0x4209e0
push edx
push eax
call edi
test eax, eax
jne 0x40a7e4
mov dword [esp + 0x10], 0x2ba
jmp 0x413888
mov ecx, dword [0x428724]
mov edx, dword [esi + 0x6c]
push 0
push 0x1a
push 0x420638
push ecx
push edx
call edi
test eax, eax
jne 0x40a80b
mov dword [esp + 0x10], 0x2c5
jmp 0x413888
mov eax, dword [0x42871c]
mov ecx, dword [esi + 0x6c]
push 0
push 0x1e
push 0x420800
push eax
push ecx
call edi
test eax, eax
jne 0x40a831
mov dword [esp + 0x10], 0x2cd
jmp 0x413888
mov edx, dword [0x4286f4]
mov eax, dword [esi + 0x6c]
push 0
push 0xd
push 0x420ca8
push edx
push eax
call edi
test eax, eax
jne 0x40a858
mov dword [esp + 0x10], 0x2d5
jmp 0x413888
mov ecx, dword [0x4286e4]
mov edx, dword [esi + 0x6c]
push 0
push 0x20
push 0x420e50
push ecx
push edx
call edi
test eax, eax
jne 0x40a87f
mov dword [esp + 0x10], 0x2dd
jmp 0x413888
mov eax, dword [0x4286e0]
mov ecx, dword [esi + 0x6c]
push 0
push 0x2f
push 0x420ed0
push eax
push ecx
call edi
test eax, eax
jne 0x40a8a5
mov dword [esp + 0x10], 0x2df
jmp 0x413888
mov edx, dword [0x4286d0]
mov eax, dword [esi + 0x6c]
push 0
push 0x31
push 0x421060
push edx
push eax
call edi
test eax, eax
jne 0x40a8cc
mov dword [esp + 0x10], 0x2e7
jmp 0x413888
mov ecx, dword [0x4286cc]
mov edx, dword [esi + 0x6c]
push 0
push 0x66
push 0x4210c0
push ecx
push edx
call edi
test eax, eax
jne 0x40a8f3
mov dword [esp + 0x10], 0x2ee
jmp 0x413888
mov eax, dword [0x428684]
mov ecx, dword [esi + 0x6c]
push 0
push 0x17
push 0x421880
push eax
push ecx
call edi
test eax, eax
jne 0x40a919
mov dword [esp + 0x10], 0x2f5
jmp 0x413888
mov edx, dword [0x428670]
mov eax, dword [esi + 0x6c]
push 0
push 0x5c
push 0x4219e8
push edx
push eax
call edi
test eax, eax
jne 0x40a940
mov dword [esp + 0x10], 0x2ad
jmp 0x413888
mov ecx, dword [0x42865c]
mov edx, dword [esi + 0x6c]
push 0
push 0x5d
push 0x421bf8
push ecx
push edx
call edi
test eax, eax
jne 0x40a967
mov dword [esp + 0x10], 0x2ff
jmp 0x413888
mov eax, dword [0x428654]
mov ecx, dword [esi + 0x6c]
push 0
push 0x28
push 0x421db0
push eax
push ecx
call edi
test eax, eax
jne 0x40a98d
mov dword [esp + 0x10], 0x307
jmp 0x413888
mov edx, dword [0x428640]
mov eax, dword [esi + 0x6c]
push 0
push 0x1b
push 0x421fd0
push edx
push eax
call edi
test eax, eax
jne 0x40a9b4
mov dword [esp + 0x10], 0x30f
jmp 0x413888
mov ecx, dword [0x4285dc]
mov edx, dword [esi + 0x6c]
push 0
push 0x20
push 0x422bd4
push ecx
push edx
call edi
test eax, eax
jne 0x40a9db
mov dword [esp + 0x10], 0x317
jmp 0x413888
mov eax, dword [0x428610]
mov ecx, dword [esi + 0x6c]
push 0
push 0xb
push 0x422600
push eax
push ecx
call edi
test eax, eax
jne 0x40aa01
mov dword [esp + 0x10], 0x31d
jmp 0x413888
mov edx, dword [0x4285f0]
mov eax, dword [esi + 0x6c]
push 0
push 0xa5
push 0x422898
push edx
push eax
call edi
test eax, eax
jne 0x40aa2b
mov dword [esp + 0x10], 0x27b
jmp 0x413888
mov ecx, dword [0x4285b0]
mov edx, dword [esi + 0x6c]
push 0
push 0x4f
push 0x4230c8
push ecx
push edx
call edi
test eax, eax
jne 0x40aa52
mov dword [esp + 0x10], 0x32f
jmp 0x413888
mov eax, dword [0x4285a8]
mov ecx, dword [esi + 0x6c]
push 0
push 0x1d
push 0x423208
push eax
push ecx
call edi
test eax, eax
jne 0x40aa78
mov dword [esp + 0x10], 0x331
jmp 0x413888
mov edx, dword [0x4285b8]
mov eax, dword [esi + 0x6c]
push 0
push 0xc3
push 0x422f50
push edx
push eax
call edi
test eax, eax
jne 0x40aaa2
mov dword [esp + 0x10], 0x339
jmp 0x413888
mov ecx, dword [0x4285cc]
mov edx, dword [esi + 0x6c]
push 0
push 0x2f
push 0x422cf8
push ecx
push edx
call edi
test eax, eax
jne 0x40aac9
mov dword [esp + 0x10], 0x340
jmp 0x413888
mov eax, dword [0x428668]
mov ecx, dword [esi + 0x6c]
push 0
push 0x49
push 0x421ac0
push eax
push ecx
call edi
test eax, eax
jne 0x40aaef
mov dword [esp + 0x10], 0x347
jmp 0x413888
mov edx, dword [0x42857c]
mov eax, dword [esi + 0x6c]
push 0
push 0xbc
push 0x423698
push edx
push eax
call edi
test eax, eax
jne 0x40ab19
mov dword [esp + 0x10], 0x354
jmp 0x413888
mov ecx, dword [0x4285f8]
mov edx, dword [esi + 0x6c]
push 0
push 0x10
push 0x422828
push ecx
push edx
call edi
test eax, eax
jne 0x40ab40
mov dword [esp + 0x10], 0x35c
jmp 0x413888
mov eax, dword [0x4285f4]
mov ecx, dword [esi + 0x6c]
push 0
push 0x10
push 0x422860
push eax
push ecx
call edi
test eax, eax
jne 0x40ab66
mov dword [esp + 0x10], 0x35c
jmp 0x413888
mov edx, dword [0x428628]
mov eax, dword [esi + 0x6c]
push 0
push 0x81
push 0x422218
push edx
push eax
call edi
test eax, eax
jne 0x40ab90
cmp dword [esp + 0x40], 4
jne 0x413276
mov ecx, dword [esi + 0x1110]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x1114]
push 2
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411b9e
mov dword [esp + 0x10], 0x188
jmp 0x413888
mov ecx, dword [esi + 0xe50]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x1d0]
push 0xc80
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411bca
mov dword [esp + 0x10], 0x1c5
jmp 0x413888
mov ecx, dword [esi + 0x110c]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0xe54]
push 0x2b8
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411bf6
mov dword [esp + 0x10], 0x1f4
jmp 0x413888
mov al, byte [esi + 0x150]
push 0
mov byte [0x42834c], al
mov cl, byte [esi + 0x154]
mov byte [0x42834d], cl
mov dl, byte [esi + 0x158]
mov byte [0x42834e], dl
mov al, byte [esi + 0x15c]
mov byte [0x42834f], al
mov cl, byte [esi + 0x160]
mov byte [0x428350], cl
mov dl, byte [esi + 0x164]
mov byte [0x428351], dl
mov al, byte [esi + 0x168]
mov byte [0x428352], al
mov cl, byte [esi + 0x16c]
mov eax, dword [0x427180]
mov byte [0x428353], cl
mov dl, byte [esi + 0x170]
push 9
mov byte [0x428354], dl
mov ecx, dword [esi + 0x6c]
push 0x42834c
push eax
push ecx
call edi
test eax, eax
jne 0x411c85
mov dword [esp + 0x10], 0x12c
jmp 0x413888
mov edx, dword [esi + 0x174]
mov ecx, dword [0x428598]
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x6c]
push 4
add ecx, 2
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411cb9
mov dword [esp + 0x10], 0x16e
jmp 0x413888
mov ecx, dword [0x428380]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 4
add ecx, 0xc
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411ce3
mov dword [esp + 0x10], 0x16e
jmp 0x413888
mov eax, dword [esi + 0x178]
mov edx, dword [0x4286e0]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6c]
push 1
add edx, 0x1d
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x411d17
mov dword [esp + 0x10], 0x18b
jmp 0x413888
mov ecx, dword [esi + 0x17c]
mov edx, dword [esi + 0x1be8]
push 0
push 1
lea eax, [edx + ecx*4]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov edx, dword [esi + 0x1be4]
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x411d51
mov dword [esp + 0x10], 0x191
jmp 0x413888
mov ecx, dword [esi + 0xdc]
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x425204]
mov edx, dword [eax + 0x425208]
mov eax, dword [eax + 0x425200]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x411d96
mov dword [esp + 0x10], 0x3cb
jmp 0x413888
mov eax, dword [esi + 0x1d30]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esi + 0x180]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x411dbf
mov dword [esp + 0x10], 0x175
jmp 0x413888
mov edx, dword [esi + 0x184]
mov eax, 0x28
shl edx, 1
sub eax, edx
mov edx, dword [0x4283e0]
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6c]
push 1
add edx, 8
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x411dfc
mov dword [esp + 0x10], 0x198
jmp 0x413888
mov eax, dword [esi + 0x188]
test eax, eax
mov dword [esp + 0x10], eax
je 0x411e15
mov ecx, 0xa
sub ecx, eax
mov dword [esp + 0x10], ecx
mov eax, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push 0x43f4cc
push eax
call edi
test eax, eax
jne 0x411e3a
mov dword [esp + 0x10], 0x1a3
jmp 0x413888
mov edx, dword [esi + 0x6c]
push 0
lea ecx, [esi + 0x18c]
push 1
push ecx
push 0x43f4cf
push edx
call edi
test eax, eax
jne 0x411e61
mov dword [esp + 0x10], 0x1aa
jmp 0x413888
mov ecx, dword [esi + 0x1cf4]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x190]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411e8a
mov dword [esp + 0x10], 0x1a5
jmp 0x413888
mov ecx, dword [esi + 0x1cf4]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x194]
push 1
add ecx, 8
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411eb6
mov dword [esp + 0x10], 0x1a5
jmp 0x413888
mov ecx, dword [esi + 0x1cf4]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x198]
push 1
add ecx, 0x10
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411ee2
mov dword [esp + 0x10], 0x1a5
jmp 0x413888
mov ecx, dword [esi + 0x1cf4]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x19c]
push 1
add ecx, 0x18
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411f0e
mov dword [esp + 0x10], 0x1a5
jmp 0x413888
mov ecx, dword [esi + 0x1cf4]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x1a0]
push 1
add ecx, 0x20
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411f3a
mov dword [esp + 0x10], 0x1a5
jmp 0x413888
mov eax, dword [esi + 0x6c]
lea ebx, [esi + 0x1a4]
push 0
push 1
push ebx
push 0x43ff19
push eax
call edi
test eax, eax
jne 0x411f61
mov dword [esp + 0x10], 0x185
jmp 0x413888
mov ecx, dword [ebx]
mov edx, 4
shr ecx, 2
sub edx, ecx
push 0
mov dword [esp + 0x14], edx
mov ecx, dword [esi + 0x19c0]
mov edx, dword [esi + 0x6c]
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411f98
mov dword [esp + 0x10], 0x151
jmp 0x413888
mov ecx, dword [esi + 0x1ce0]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x1a8]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x411fc1
mov dword [esp + 0x10], 0x152
jmp 0x413888
mov ecx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x1ac]
push 1
push eax
push 0x43ff1a
push ecx
call edi
test eax, eax
jne 0x411fe8
mov dword [esp + 0x10], 0x1ae
jmp 0x413888
mov eax, dword [esi + 0x6c]
push 0
lea edx, [esi + 0x1b0]
push 1
push edx
push 0x43ff1d
push eax
call edi
test eax, eax
jne 0x41200f
mov dword [esp + 0x10], 0x15b
jmp 0x413888
mov edx, dword [esi + 0x6c]
push 0
lea ecx, [esi + 0x1b4]
push 1
push ecx
push 0x43f3d1
push edx
call edi
test eax, eax
jne 0x412036
mov dword [esp + 0x10], 0x1b0
jmp 0x413888
mov ecx, dword [esi + 0x1cf8]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x1b8]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x41205f
mov dword [esp + 0x10], 0x1b2
jmp 0x413888
mov eax, dword [esi + 0x1c8]
mov ecx, dword [esi + 0x1bc]
mov edx, dword [esi + 0x1c0]
and eax, 0x7f
shl eax, 8
and ecx, 0xff
and edx, 0xff
add eax, ecx
mov ecx, dword [esi + 0x1c4]
shl eax, 8
add eax, edx
and ecx, 0xff
shl eax, 8
add eax, ecx
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6c]
push 4
push edx
push 0x43f887
push eax
call edi
test eax, eax
jne 0x4120c4
mov dword [esp + 0x10], 0x19c
jmp 0x413888
mov edx, dword [esi + 0x6c]
push 0
lea ecx, [esi + 0x1cc]
push 1
push ecx
push 0x43f88f
push edx
call edi
test eax, eax
jne 0x4120eb
mov dword [esp + 0x10], 0x1a2
jmp 0x413888
mov eax, dword [esi + 0x12b8]
mov ecx, dword [esi + 0x6c]
push 0
push 0x190
push 0x427b60
push eax
push ecx
call edi
test eax, eax
jne 0x412115
mov dword [esp + 0x10], 0x1c4
jmp 0x413888
mov edx, dword [esi + 0x12bc]
mov eax, dword [esi + 0x6c]
push 0
push 0x32
push 0x427cf0
push edx
push eax
call edi
test eax, eax
jne 0x41213c
mov dword [esp + 0x10], 0x1c3
jmp 0x413888
mov ecx, dword [esi + 0x90]
push 0
neg ecx
sbb ecx, ecx
lea edx, [esp + 0x14]
and ecx, 0x32
push 1
mov dword [esp + 0x18], ecx
mov eax, dword [esi + 0x182c]
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412174
mov dword [esp + 0x10], 0x12e
jmp 0x413888
mov eax, dword [esi + 0x1830]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x41219b
mov dword [esp + 0x10], 0x12e
jmp 0x413888
mov eax, dword [esi + 0xcc]
test eax, eax
jne 0x4121b1
mov edx, dword [esi + 0x19d0]
mov dword [esp + 0x10], edx
jmp 0x4121bb
mov eax, dword [esi + 0x19cc]
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x19c8]
mov eax, dword [esi + 0x6c]
push 0
lea ecx, [esp + 0x14]
push 1
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x4121e2
mov dword [esp + 0x10], 0x158
jmp 0x413888
mov ecx, dword [esi + 0x104]
mov eax, dword [0x4284b4]
neg ecx
sbb ecx, ecx
push 0
and ecx, 0x91ae
lea edx, [esp + 0x14]
add ecx, 0x27eb
push 2
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412222
mov dword [esp + 0x10], 0x156
jmp 0x413888
mov edx, dword [esi + 0xd4]
mov ecx, dword [0x41dd64]
neg edx
sbb edx, edx
push 0
and edx, 0xffffffae
lea eax, [esp + 0x14]
add edx, 0x85
push 1
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0x6c]
add ecx, 5
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412263
mov dword [esp + 0x10], 0x157
jmp 0x413888
mov eax, dword [esi + 0xd8]
mov edx, dword [0x4286dc]
neg eax
sbb eax, eax
push 0
and al, 0xfe
lea ecx, [esp + 0x14]
add eax, 0xcc
push 1
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x6c]
add edx, 0x58
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x4122a2
mov dword [esp + 0x10], 0x15d
jmp 0x413888
mov eax, dword [esi + 0xd0]
test eax, eax
jne 0x4122b8
mov ecx, dword [esi + 0x19e4]
mov dword [esp + 0x10], ecx
jmp 0x4122c2
mov edx, dword [esi + 0x19e0]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x19d4]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x4122e9
mov dword [esp + 0x10], 0x159
jmp 0x413888
mov ecx, dword [esi + 0x19d8]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412310
mov dword [esp + 0x10], 0x159
jmp 0x413888
mov ecx, dword [esi + 0x19dc]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412337
mov dword [esp + 0x10], 0x159
jmp 0x413888
mov ecx, dword [esi + 0xe0]
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x423b4c]
mov edx, dword [eax + 0x423b50]
mov eax, dword [eax + 0x423b48]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x41237c
mov dword [esp + 0x10], 0x3a1
jmp 0x413888
mov eax, dword [esi + 0xe0]
test eax, eax
jne 0x412392
mov edx, dword [esi + 0x1bbc]
mov dword [esp + 0x10], edx
jmp 0x41239c
mov eax, dword [esi + 0x1bb8]
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x1bb4]
mov eax, dword [esi + 0x6c]
push 0
lea ecx, [esp + 0x14]
push 1
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x4123c3
mov dword [esp + 0x10], 0x196
jmp 0x413888
mov ecx, dword [esi + 0xe0]
xor eax, eax
test ecx, ecx
setne al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x4244ac]
mov edx, dword [eax + 0x4244b0]
mov eax, dword [eax + 0x4244a8]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412408
mov dword [esp + 0x10], 0x39f
jmp 0x413888
mov ebp, dword [esi + 0xe0]
xor eax, eax
test ebp, ebp
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov edx, dword [eax + 0x42758c]
mov ecx, dword [eax + 0x427590]
push edx
mov edx, dword [eax + 0x427588]
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x41244d
mov dword [esp + 0x10], 0x43f
jmp 0x413888
mov ecx, dword [esi + 0x11c]
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x4266d4]
mov edx, dword [eax + 0x4266d8]
mov eax, dword [eax + 0x4266d0]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412492
mov dword [esp + 0x10], 0x408
jmp 0x413888
mov ebp, dword [esi + 0x14c]
xor eax, eax
test ebp, ebp
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov edx, dword [eax + 0x427ab4]
mov ecx, dword [eax + 0x427ab8]
push edx
mov edx, dword [eax + 0x427ab0]
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x4124d7
mov dword [esp + 0x10], 0x450
jmp 0x413888
mov eax, dword [esi + 0xe4]
test eax, eax
jne 0x4124ed
mov ecx, dword [esi + 0x1a64]
mov dword [esp + 0x10], ecx
jmp 0x4124f7
mov edx, dword [esi + 0x1a60]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1a5c]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x41251e
mov dword [esp + 0x10], 0x150
jmp 0x413888
mov eax, dword [esi + 0xe4]
test eax, eax
jne 0x412534
mov eax, dword [esi + 0x1a70]
mov dword [esp + 0x10], eax
jmp 0x41253e
mov ecx, dword [esi + 0x1a6c]
mov dword [esp + 0x10], ecx
mov eax, dword [esi + 0x1a68]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412565
mov dword [esp + 0x10], 0x150
jmp 0x413888
mov ebp, dword [esi + 0x10c]
xor eax, eax
test ebp, ebp
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov edx, dword [eax + 0x42665c]
mov ecx, dword [eax + 0x426660]
push edx
mov edx, dword [eax + 0x426658]
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x4125aa
mov dword [esp + 0x10], 0x3ef
jmp 0x413888
mov ecx, dword [esi + 0x94]
mov eax, dword [0x428658]
neg ecx
sbb ecx, ecx
push 0
and ecx, 5
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x6c]
push 1
add eax, 0x1a
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x4125e4
mov dword [esp + 0x10], 0x166
jmp 0x413888
mov ebp, dword [esi + 0x94]
mov ecx, dword [0x428654]
xor edx, edx
push 0
test ebp, ebp
setne dl
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x6c]
push 1
add ecx, 9
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x41261f
mov dword [esp + 0x10], 0x166
jmp 0x413888
mov eax, dword [esi + 0x94]
mov edx, dword [0x4285bc]
neg eax
sbb eax, eax
push 0
and al, 0x8a
lea ecx, [esp + 0x14]
add eax, 0xeb
push 1
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x6c]
add edx, 4
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x41265e
mov dword [esp + 0x10], 0x166
jmp 0x413888
mov eax, dword [esi + 0xe8]
test eax, eax
jne 0x412674
mov ecx, dword [esi + 0x1aec]
mov dword [esp + 0x10], ecx
jmp 0x41267e
mov edx, dword [esi + 0x1ae8]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1ae4]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x4126a5
mov dword [esp + 0x10], 0x16c
jmp 0x413888
mov eax, dword [esi + 0xec]
test eax, eax
jne 0x4126bb
mov eax, dword [esi + 0x1b10]
mov dword [esp + 0x10], eax
jmp 0x4126c5
mov ecx, dword [esi + 0x1b0c]
mov dword [esp + 0x10], ecx
mov eax, dword [esi + 0x1b08]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x4126ec
mov dword [esp + 0x10], 0x170
jmp 0x413888
mov eax, dword [esi + 0xec]
test eax, eax
jne 0x412702
mov edx, dword [esi + 0x1b1c]
mov dword [esp + 0x10], edx
jmp 0x41270c
mov eax, dword [esi + 0x1b18]
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x1b14]
mov eax, dword [esi + 0x6c]
push 0
lea ecx, [esp + 0x14]
push 1
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x412733
mov dword [esp + 0x10], 0x170
jmp 0x413888
mov eax, dword [esi + 0xec]
test eax, eax
jne 0x412749
mov ecx, dword [esi + 0x1b28]
mov dword [esp + 0x10], ecx
jmp 0x412753
mov edx, dword [esi + 0x1b24]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1b20]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x41277a
mov dword [esp + 0x10], 0x170
jmp 0x413888
mov eax, dword [esi + 0xf0]
mov edx, dword [0x41dd60]
neg eax
sbb eax, eax
push 0
and al, 0x9f
lea ecx, [esp + 0x14]
add eax, 0x7f
push 1
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x6c]
add edx, 0xb
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x4127b7
mov dword [esp + 0x10], 0x171
jmp 0x413888
mov ecx, dword [esi + 0xf4]
mov eax, dword [0x428568]
neg ecx
sbb ecx, ecx
push 0
and ecx, 0xfffffffd
lea edx, [esp + 0x14]
add ecx, 3
push 1
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x6c]
add eax, 0x29
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x4127f4
mov dword [esp + 0x10], 0x18f
jmp 0x413888
mov eax, dword [esi + 0xf8]
test eax, eax
jne 0x41280a
mov edx, dword [esi + 0x1b4c]
mov dword [esp + 0x10], edx
jmp 0x412814
mov eax, dword [esi + 0x1b48]
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x1b44]
mov eax, dword [esi + 0x6c]
push 0
lea ecx, [esp + 0x14]
push 1
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x41283b
mov dword [esp + 0x10], 0x15e
jmp 0x413888
mov eax, dword [esi + 0xa8]
test eax, eax
jne 0x412851
mov ecx, dword [esi + 0x1c30]
mov dword [esp + 0x10], ecx
jmp 0x41285b
mov edx, dword [esi + 0x1c2c]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1c28]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412882
mov dword [esp + 0x10], 0x18a
jmp 0x413888
mov ebx, dword [esi + 0xb0]
xor eax, eax
test ebx, ebx
setne al
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov edx, dword [esi + 0x6c]
push 1
push ecx
push 0x43ff1c
push edx
call edi
test eax, eax
jne 0x4128b8
mov dword [esp + 0x10], 0x19b
jmp 0x413888
mov eax, dword [esi + 0x108]
mov edx, dword [0x428480]
neg eax
sbb eax, eax
push 0
and eax, 6
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6c]
push 1
inc edx
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x4128f1
mov dword [esp + 0x10], 0x190
jmp 0x413888
mov ecx, dword [esi + 0xa4]
mov eax, dword [0x428540]
neg ecx
sbb ecx, ecx
push 0
and ecx, 0xffffff89
lea edx, [esp + 0x14]
add ecx, 0xeb
push 1
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x6c]
add eax, 0x2d
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412931
mov dword [esp + 0x10], 0x184
jmp 0x413888
mov edx, dword [esi + 0x98]
mov ecx, dword [0x41db34]
neg edx
sbb edx, edx
push 0
and edx, 2
lea eax, [esp + 0x14]
inc edx
push 1
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0x6c]
add ecx, 3
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x41296d
mov dword [esp + 0x10], 0x176
jmp 0x413888
mov eax, dword [esi + 0x98]
mov edx, dword [0x41dbc0]
neg eax
sbb eax, eax
push 0
and eax, 4
lea ecx, [esp + 0x14]
add eax, 5
push 1
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x6c]
add edx, 0x1d
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x4129ab
mov dword [esp + 0x10], 0x176
jmp 0x413888
mov edx, dword [esi + 0x9c]
xor ecx, ecx
test edx, edx
setne cl
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov eax, dword [esi + 0x6c]
push 1
push edx
push 0x43ff16
push eax
call edi
test eax, eax
jne 0x4129e1
mov dword [esp + 0x10], 0x177
jmp 0x413888
mov eax, dword [esi + 0x110]
test eax, eax
jne 0x4129f7
mov ecx, dword [esi + 0x1a44]
mov dword [esp + 0x10], ecx
jmp 0x412a01
mov edx, dword [esi + 0x1a40]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1a48]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412a28
mov dword [esp + 0x10], 0x18c
jmp 0x413888
mov ecx, dword [esi + 0x1a3c]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412a4f
mov dword [esp + 0x10], 0x13f
jmp 0x413888
mov ecx, dword [esi + 0x1a3c]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
add ecx, 0x30
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412a79
mov dword [esp + 0x10], 0x13f
jmp 0x413888
mov ecx, dword [esi + 0x1a3c]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
add ecx, 0x60
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412aa3
mov dword [esp + 0x10], 0x13f
jmp 0x413888
mov ecx, dword [esi + 0x1a3c]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
add ecx, 0x90
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412ad0
mov dword [esp + 0x10], 0x13f
jmp 0x413888
mov ebx, dword [esi + 0xfc]
xor eax, eax
test ebx, ebx
setne al
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov edx, dword [esi + 0x6c]
push 1
push ecx
push 0x43ff17
push edx
call edi
test eax, eax
jne 0x412b06
mov dword [esp + 0x10], 0x178
jmp 0x413888
mov eax, dword [esi + 0x100]
mov edx, dword [0x428570]
neg eax
sbb eax, eax
push 0
and eax, 0xe
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6c]
push 1
inc edx
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x412b3f
mov dword [esp + 0x10], 0x179
jmp 0x413888
mov ecx, dword [esi + 0xac]
mov eax, dword [0x428394]
neg ecx
sbb ecx, ecx
push 0
and ecx, 0xffffff93
lea edx, [esp + 0x14]
add ecx, 0xc3
push 1
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412b7c
mov dword [esp + 0x10], 0x15f
jmp 0x413888
mov edx, dword [esi + 0xa0]
mov ecx, dword [0x428784]
neg edx
sbb edx, edx
push 0
and edx, 0xffffff8a
lea eax, [esp + 0x14]
add edx, 0xeb
push 1
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0x6c]
add ecx, 0x14
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412bbd
mov dword [esp + 0x10], 0x180
jmp 0x413888
mov ebx, dword [esi + 0xe8]
xor eax, eax
test ebx, ebx
setne al
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov edx, dword [esi + 0x6c]
push 1
push ecx
push 0x43f4cd
push edx
call edi
test eax, eax
jne 0x412bf3
mov dword [esp + 0x10], 0x16c
jmp 0x413888
mov eax, dword [esi + 0x114]
mov edx, dword [0x42838c]
neg eax
sbb eax, eax
push 0
and al, 0x93
lea ecx, [esp + 0x14]
add eax, 0xc3
push 1
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x412c2f
mov dword [esp + 0x10], 0x194
jmp 0x413888
mov eax, dword [esi + 0x118]
test eax, eax
jne 0x412c45
mov ecx, dword [esi + 0x1b04]
mov dword [esp + 0x10], ecx
jmp 0x412c4f
mov edx, dword [esi + 0x1b00]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1afc]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412c76
mov dword [esp + 0x10], 0x13c
jmp 0x413888
mov ecx, dword [esi + 0x120]
xor eax, eax
test ecx, ecx
setne al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x41d84c]
mov edx, dword [eax + 0x41d850]
mov eax, dword [eax + 0x41d848]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412cbb
mov dword [esp + 0x10], 0x6d
jmp 0x413888
mov ebp, dword [esi + 0x128]
xor eax, eax
test ebp, ebp
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov edx, dword [eax + 0x4218ac]
mov ecx, dword [eax + 0x4218b0]
push edx
mov edx, dword [eax + 0x4218a8]
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x412d00
mov dword [esp + 0x10], 0x2f6
jmp 0x413888
mov ecx, dword [esi + 0xb8]
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x42104c]
mov edx, dword [eax + 0x421050]
mov eax, dword [eax + 0x421048]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412d45
mov dword [esp + 0x10], 0x2e4
jmp 0x413888
mov ebp, dword [esi + 0x12c]
xor eax, eax
test ebp, ebp
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov edx, dword [eax + 0x42716c]
mov ecx, dword [eax + 0x427170]
push edx
mov edx, dword [eax + 0x427168]
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x412d8a
mov dword [esp + 0x10], 0xf2
jmp 0x413888
mov edx, dword [esi + 0xbc]
xor ecx, ecx
test edx, edx
setne cl
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov eax, dword [esi + 0x6c]
push 1
push edx
push 0x43f4ce
push eax
call edi
test eax, eax
jne 0x412dc0
mov dword [esp + 0x10], 0x1a8
jmp 0x413888
mov eax, dword [esi + 0xc0]
test eax, eax
jne 0x412dd6
mov ecx, dword [esi + 0x1a10]
mov dword [esp + 0x10], ecx
jmp 0x412de0
mov edx, dword [esi + 0x1a0c]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1a08]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412e07
mov dword [esp + 0x10], 0x15b
jmp 0x413888
mov eax, dword [esi + 0xc0]
test eax, eax
jne 0x412e1d
mov eax, dword [esi + 0x1a1c]
mov dword [esp + 0x10], eax
jmp 0x412e27
mov ecx, dword [esi + 0x1a18]
mov dword [esp + 0x10], ecx
mov eax, dword [esi + 0x1a14]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412e4e
mov dword [esp + 0x10], 0x15b
jmp 0x413888
mov edx, dword [esi + 0x130]
mov ecx, dword [0x4286dc]
neg edx
sbb edx, edx
push 0
and edx, 0xef0c
lea eax, [esp + 0x14]
add edx, 0x2eb
push 2
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0x6c]
add ecx, 0x21
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412e92
mov dword [esp + 0x10], 0x15d
jmp 0x413888
mov ebx, dword [esi + 0xc4]
xor eax, eax
test ebx, ebx
setne al
push 0
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov edx, dword [esi + 0x6c]
push 1
push ecx
push 0x43ff18
push edx
call edi
test eax, eax
jne 0x412ec8
mov dword [esp + 0x10], 0x1ad
jmp 0x413888
mov ecx, dword [esi + 0x134]
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov ecx, dword [eax + 0x4275ec]
mov edx, dword [eax + 0x4275f0]
mov eax, dword [eax + 0x4275e8]
push ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x412f0d
mov dword [esp + 0x10], 0x441
jmp 0x413888
mov ebx, dword [esi + 0x138]
xor edx, edx
test ebx, ebx
setne dl
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edx
mov ecx, dword [esi + 0x6c]
push 1
push eax
push 0x43ff1b
push ecx
call edi
test eax, eax
jne 0x412f43
mov dword [esp + 0x10], 0x1af
jmp 0x413888
mov ebp, dword [esi + 0x13c]
xor eax, eax
test ebp, ebp
sete al
mov dword [esp + 0x10], eax
push 0
lea eax, [eax + eax*2]
shl eax, 2
mov edx, dword [eax + 0x4278f4]
mov ecx, dword [eax + 0x4278f8]
push edx
mov edx, dword [eax + 0x4278f0]
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x412f88
mov dword [esp + 0x10], 0x44a
jmp 0x413888
mov eax, dword [esi + 0x140]
test eax, eax
jne 0x412f9e
mov ecx, dword [esi + 0x1cf0]
mov dword [esp + 0x10], ecx
jmp 0x412fa8
mov edx, dword [esi + 0x1cec]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1ce8]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x412fcf
mov dword [esp + 0x10], 0x1b1
jmp 0x413888
mov eax, dword [esi + 0x144]
test eax, eax
jne 0x412fe5
mov eax, dword [esi + 0x1864]
mov dword [esp + 0x10], eax
jmp 0x412fef
mov ecx, dword [esi + 0x1860]
mov dword [esp + 0x10], ecx
mov eax, dword [esi + 0x185c]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x413016
mov dword [esp + 0x10], 0x132
jmp 0x413888
mov eax, dword [esi + 0x144]
test eax, eax
jne 0x41302c
mov edx, dword [esi + 0x1870]
mov dword [esp + 0x10], edx
jmp 0x413036
mov eax, dword [esi + 0x186c]
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x1868]
mov eax, dword [esi + 0x6c]
push 0
lea ecx, [esp + 0x14]
push 1
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x41305d
mov dword [esp + 0x10], 0x133
jmp 0x413888
mov eax, dword [esi + 0xc8]
test eax, eax
jne 0x413073
mov ecx, dword [esi + 0x1d08]
mov dword [esp + 0x10], ecx
jmp 0x41307d
mov edx, dword [esi + 0x1d04]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1d00]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x4130a4
mov dword [esp + 0x10], 0x1b3
jmp 0x413888
mov ecx, dword [esi + 0x1d0c]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x4130cb
mov dword [esp + 0x10], 0x1b3
jmp 0x413888
mov eax, dword [esi + 0x148]
test eax, eax
jne 0x4130e1
mov eax, dword [esi + 0x19f8]
mov dword [esp + 0x10], eax
jmp 0x4130eb
mov ecx, dword [esi + 0x19f4]
mov dword [esp + 0x10], ecx
mov eax, dword [esi + 0x19e8]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x413112
mov dword [esp + 0x10], 0x159
jmp 0x413888
mov eax, dword [esi + 0x19ec]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x413139
mov dword [esp + 0x10], 0x159
jmp 0x413888
mov eax, dword [esi + 0x19f0]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x413160
mov dword [esp + 0x10], 0x159
jmp 0x413888
mov edx, dword [esi + 0xb4]
mov ecx, dword [0x4283fc]
neg edx
sbb edx, edx
push 0
and edx, 0xbb48
lea eax, [esp + 0x14]
add edx, 0x16eb
push 2
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x4131a1
mov dword [esp + 0x10], 0x19d
jmp 0x413888
mov eax, dword [esi + 0xb4]
test eax, eax
jne 0x4131b7
mov eax, dword [esi + 0x1c70]
mov dword [esp + 0x10], eax
jmp 0x4131c1
mov ecx, dword [esi + 0x1c6c]
mov dword [esp + 0x10], ecx
mov eax, dword [esi + 0x1c68]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
push edx
push eax
push ecx
call edi
test eax, eax
jne 0x4131e8
mov dword [esp + 0x10], 0x19f
jmp 0x413888
mov eax, dword [esi + 0xb4]
test eax, eax
jne 0x4131fe
mov edx, dword [esi + 0x1c7c]
mov dword [esp + 0x10], edx
jmp 0x413208
mov eax, dword [esi + 0x1c78]
mov dword [esp + 0x10], eax
mov edx, dword [esi + 0x1c74]
mov eax, dword [esi + 0x6c]
push 0
lea ecx, [esp + 0x14]
push 1
push ecx
push edx
push eax
call edi
test eax, eax
jne 0x41322f
mov dword [esp + 0x10], 0x1a0
jmp 0x413888
mov eax, dword [esi + 0xb4]
test eax, eax
jne 0x413245
mov ecx, dword [esi + 0x1c88]
mov dword [esp + 0x10], ecx
jmp 0x41324f
mov edx, dword [esi + 0x1c84]
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 0x1c80]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x413292
mov dword [esp + 0x10], 0x1a1
jmp 0x413888
mov eax, dword [esp + 0x40]
cmp eax, 2
je 0x413292
cmp eax, 3
je 0x413292
cmp eax, 1
je 0x413910
jmp 0x41397f
mov ecx, dword [esi + 0x1118]
xor eax, eax
cmp ecx, eax
jne 0x413335
cmp dword [esi + 0x111c], eax
jne 0x413335
cmp dword [esp + 0x40], 1
jne 0x4135e1
lea ebx, [esi + 0x1286]
mov ebp, 0xffffed7a
mov eax, ebx
lea ecx, [esi + 0x1123]
sub ebp, esi
mov dl, byte [eax - 0x32]
inc eax
mov byte [ecx - 2], dl
mov dl, byte [eax - 1]
mov byte [ecx], dl
lea edx, [eax + ebp]
add ecx, 6
cmp edx, 0x32
jl 0x4132ce
mov ecx, dword [esi + 0x124c]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esi + 0x1254]
push 0x32
push eax
push ecx
push edx
call edi
test eax, eax
jne 0x41330e
mov dword [esp + 0x10], 0x1c6
jmp 0x413888
mov eax, dword [esi + 0x1250]
mov ecx, dword [esi + 0x6c]
push 0
push 0x32
push ebx
push eax
push ecx
call edi
test eax, eax
jne 0x4135e1
mov dword [esp + 0x10], 0x1c6
jmp 0x413888
lea edx, [esi + 0x1120]
mov dword [esi + 0x111c], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov ebx, 0x124dbaa
mov ecx, dword [esp + 0x20]
xor eax, eax
mov al, byte [ecx + 1]
cmp eax, 0x32
mov dword [esp + 0x10], eax
jbe 0x413368
mov dword [esp + 0x10], 0x32
mov eax, dword [esi + 0x124c]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 1
add eax, ebp
push edx
push eax
push ecx
call edi
test eax, eax
je 0x413328
mov edx, dword [esp + 0x20]
xor eax, eax
mov al, byte [edx + 3]
cmp eax, 0xa
mov dword [esp + 0x10], eax
jbe 0x4133a2
mov dword [esp + 0x10], 0xa
mov ecx, dword [esi + 0x1250]
mov edx, dword [esi + 0x6c]
push 0
lea eax, [esp + 0x14]
push 1
add ecx, ebp
push eax
push ecx
push edx
call edi
test eax, eax
je 0x413328
mov ebp, dword [esp + 0x20]
mov al, byte [ebp]
and eax, 0xf
cmp eax, 2
mov dword [esp + 0x24], eax
ja 0x4133e5
lea ecx, [eax + 1]
mov eax, 1
shl eax, cl
mov dword [esp + 0x10], eax
jmp 0x4133ed
mov dword [esp + 0x10], 0
mov eax, dword [esi + 0x6c]
push 0
lea ecx, [esp + 0x14]
push 1
lea edx, [ebx - 1]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x413328
mov eax, dword [esp + 0x24]
cmp eax, 2
jbe 0x41346e
xor ecx, ecx
cmp eax, 3
setne cl
dec ecx
push 0
and ecx, 0x80
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov eax, dword [esi + 0x6c]
push 1
push edx
push ebx
push eax
call edi
test eax, eax
je 0x413328
mov eax, dword [esp + 0x24]
cmp eax, 3
je 0x41346e
lea ecx, [eax - 4]
mov edx, 1
shl edx, cl
push 0
lea eax, [esp + 0x14]
push 1
lea ecx, [ebx + 1]
push eax
push ecx
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0x6c]
push edx
call edi
test eax, eax
je 0x413328
mov al, byte [ebp]
push 0
and eax, 0x10
lea ecx, [esp + 0x14]
shl eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6c]
push 1
lea edx, [ebx + 2]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x413328
mov cl, byte [ebp]
push 0
shr ecx, 5
and ecx, 1
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x6c]
push 1
lea eax, [ebx + 3]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x413328
mov eax, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x28]
lea ebp, [ebx + 0x18e]
push 1
push edx
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x4136a0
mov edx, dword [esp + 0x20]
xor ecx, ecx
push 0
lea eax, [esp + 0x14]
mov cl, byte [edx]
mov edx, dword [esp + 0x28]
shr ecx, 7
or ecx, edx
push 1
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x6c]
push eax
push ebp
push ecx
call edi
test eax, eax
je 0x413328
mov ebp, dword [esp + 0x20]
xor eax, eax
mov al, byte [ebp + 4]
cmp eax, 0xa
jbe 0x413520
mov eax, 0xa
lea eax, [eax + eax*4]
push 0
push 4
lea ecx, [ebx + 0x182]
lea edx, [eax + eax*4]
lea eax, [esp + 0x18]
shl edx, 2
mov dword [esp + 0x18], edx
mov edx, dword [esi + 0x6c]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x413328
xor eax, eax
mov al, byte [ebp + 5]
cmp eax, 0xa
jbe 0x41355a
mov eax, 0xa
lea eax, [eax + eax*4]
push 0
lea ecx, [esp + 0x14]
push 4
lea eax, [eax + eax*4]
lea edx, [ebx + 0x186]
shl eax, 2
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x6c]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x413328
xor eax, eax
mov al, byte [ebp + 2]
cmp eax, 0xf
jbe 0x413594
mov eax, 0xf
lea eax, [eax + eax*4]
push 0
lea edx, [esp + 0x14]
push 4
lea ecx, [eax + eax*4]
lea eax, [ebx + 0x176]
shl ecx, 2
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x6c]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x413328
mov eax, dword [esp + 0x1c]
add ebx, 0x1f0
inc eax
add ebp, 6
cmp ebx, 0x1253c8a
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebp
jl 0x41334e
mov al, byte [esi + 0x12c0]
test al, 3
je 0x4136ba
and al, 0xfd
mov ebx, 0x14fdb4c
mov byte [esi + 0x12c0], al
lea ebp, [esi + 0x12c3]
xor eax, eax
mov al, byte [ebp - 1]
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jbe 0x413618
mov dword [esp + 0x10], 0x1e
mov ecx, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 4
lea eax, [ebx - 0x18]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x4136ad
xor eax, eax
mov al, byte [ebp]
cmp eax, 0x1e
mov dword [esp + 0x10], eax
jbe 0x413645
mov dword [esp + 0x10], 0x1e
mov eax, dword [esi + 0x6c]
push 0
lea edx, [esp + 0x14]
push 4
push edx
push ebx
push eax
call edi
test eax, eax
je 0x4136ad
xor eax, eax
mov ax, word [ebp + 1]
cmp eax, 0x5dc
mov dword [esp + 0x10], eax
jbe 0x413672
mov dword [esp + 0x10], 0x5dc
mov eax, dword [esi + 0x6c]
push 0
lea ecx, [esp + 0x14]
push 4
lea edx, [ebx - 0x24]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x4136ad
add ebx, 0x8c
add ebp, 4
cmp ebx, 0x14ff0a0
jl 0x413602
jmp 0x4136ba
mov dword [esp + 0x10], 0x1c7
jmp 0x413888
mov dword [esp + 0x10], 0x1c8
jmp 0x413888
mov al, byte [esi + 0x135e]
test al, 3
je 0x4138c2
and al, 0xfd
mov dword [esp + 0x1c], 0
mov byte [esi + 0x135e], al
lea ebx, [esi + 0x1360]
mov ebp, 0x1500bd4
mov ecx, dword [ebx]
push 0
and ecx, 0x3f
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x6c]
push 1
lea eax, [ebp - 4]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x413903
mov edx, dword [ebx]
push 0
shr edx, 6
and edx, 0x3f
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edx
mov ecx, dword [esi + 0x6c]
push 1
push eax
push ebp
push ecx
call edi
test eax, eax
je 0x413903
mov edx, dword [ebx]
push 0
shr edx, 0xc
and edx, 0x3f
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x6c]
push 1
lea ecx, [ebp + 4]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x413903
mov eax, dword [ebx]
push 0
shr eax, 0x12
and eax, 0x3f
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6c]
push 1
lea edx, [ebp + 8]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x413903
mov ecx, dword [ebx]
push 0
shr ecx, 0x18
and ecx, 0x3f
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x6c]
push 1
lea eax, [ebp - 8]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x413903
mov dl, byte [ebx + 4]
push 0
and edx, 0xf
lea eax, [esp + 0x14]
push 1
mov dword [esp + 0x18], edx
mov ecx, dword [esi + 0x1438]
mov edx, dword [esi + 0x6c]
push eax
mov eax, dword [esp + 0x28]
add ecx, eax
push ecx
push edx
call edi
test eax, eax
je 0x413903
mov al, byte [ebx + 4]
push 0
shr eax, 4
and eax, 0xf
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x6c]
push 1
lea edx, [ebp + 0xc]
push ecx
push edx
push eax
call edi
test eax, eax
je 0x413903
mov cx, word [ebx + 4]
push 0
shr ecx, 8
and ecx, 0xf
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x6c]
push 1
lea eax, [ebp + 0x10]
push edx
push eax
push ecx
call edi
test eax, eax
je 0x413903
xor edx, edx
push 0
mov dx, word [ebx + 6]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x6c]
push 2
lea ecx, [ebp + 0x14]
push eax
push ecx
push edx
call edi
test eax, eax
je 0x413903
mov eax, dword [esp + 0x1c]
add ebp, 0x88
inc eax
add ebx, 8
cmp ebp, 0x1501a2c
mov dword [esp + 0x1c], eax
jl 0x4136e3
mov eax, dword [esi + 0x124]
test eax, eax
je 0x413910
push eax
mov ecx, esi
call fcn.004183c0
test eax, eax
jne 0x413910
mov dword [esp + 0x10], 0x1f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x10]
push eax
push edx
lea eax, [esp + 0x1c]
push str._d_:_error_d
push eax
call sub.MFC42.DLL_CString::Format
mov eax, dword [esi + 0x88]
add esp, 0x10
inc eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 0xfffffff8
jmp 0x41396f
cmp dword [esp + 0x40], 1
jne 0x413862
xor eax, eax
lea ecx, [esi + 0x1364]
movzx dx, byte [eax + 0x427d24]
mov word [ecx], dx
inc eax
add ecx, 8
cmp eax, 0x1b
jl 0x4138d1
mov eax, dword [esi + 0x1438]
mov ecx, dword [esi + 0x6c]
push 0
push 0x1b
push 0x427d24
push eax
push ecx
call edi
test eax, eax
jne 0x413862
mov dword [esp + 0x10], 0x1c9
jmp 0x413888
mov ecx, dword [esi + 0x8c]
inc ecx
mov eax, ecx
mov dword [esi + 0x8c], ecx
cmp eax, 1
jl 0x41397f
mov ecx, dword [esi + 0x88]
lea edx, [esp + 0x14]
push ecx
push 0x428034
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esi + 0x8c]
add esp, 0xc
cmp eax, 1
jle 0x41395c
lea edi, [eax - 1]
push 0x428030
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator
dec edi
jne 0x41394b
cmp dword [esi + 0x8c], 6
jne 0x41396f
mov dword [esi + 0x8c], 0
mov eax, dword [esp + 0x14]
lea ecx, [esi + 0x1d3c]
push eax
call sub.MFC42.DLL_CWnd::SetWindowTextA
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00418756
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 4