Function at 0x4047b0
Capabilities:
Check for foreground window switch
Hide graphical window
Log keystrokes via polling
Manipulate console buffer
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x41ea12
mov eax, dword fs:[0]
push eax
sub esp, 0x39c
mov eax, dword [0x4294c0]
xor eax, esp
mov dword [esp + 0x394], eax
push esi
push edi
mov eax, dword [0x4294c0]
xor eax, esp
push eax
lea eax, [esp + 0x3a8]
mov dword fs:[0], eax
xor eax, eax
mov dword [esp + 0x18], eax
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x10], eax
nop
cmp dword [0x42ba20], 0
je 0x40481b
cmp dword [0x42ba18], 0
je 0x40481b
cmp dword [0x42ba1c], 0
jne 0x404821
push 1
call edi
jmp 0x404800
call fcn.004045d0
push 4
push 0x425bc4
lea ecx, [esp + 0x1dc]
mov dword [esp + 0x1f0], 0xf
mov dword [esp + 0x1ec], 0
mov byte [esp + 0x1dc], 0
call fcn.00407b40
mov dword [esp + 0x3b0], 0
lea ecx, [esp + 0x1ec]
push 4
push 0x425bcc
mov dword [esp + 0x208], 0xf
mov dword [esp + 0x204], 0
mov byte [esp + 0x1f4], 0
call fcn.00407b40
mov byte [esp + 0x3b0], 1
lea ecx, [esp + 0x1bc]
push 0
push 0x425808
mov dword [esp + 0x1d8], 0xf
mov dword [esp + 0x1d4], 0
mov byte [esp + 0x1c4], 0
call fcn.00407b40
mov byte [esp + 0x3b0], 2
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x24], eax
jmp 0x404900
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call edi
mov eax, dword [0x42ba84]
test al, 1
jne 0x404926
or eax, 1
mov dword [0x42ba84], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [0x42ba90], eax
push 0x23
call esi
test ax, ax
jne 0x4068eb
push 1
call esi
test ax, ax
je 0x404951
push 0
push 2
push 0xa1
push dword [0x42ba90]
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x24
call esi
test ax, ax
je 0x40499d
xor ecx, ecx
mov eax, 5
cmp byte [0x42a4c0], cl
cmovne eax, ecx
push eax
push dword [0x42ba90]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x42a4c0], 0
push 0x24
sete byte [0x42a4c0]
call esi
test ax, ax
je 0x40499d
mov edi, edi
push 1
call edi
push 0x24
call esi
test ax, ax
jne 0x404990
push 0x78
call esi
test ax, ax
je 0x404ae1
push 0x78
lea eax, [esp + 0x290]
push 0
push eax
call fcn.0040ddc0
add esp, 0xc
mov dword [esp + 0x188], 0xf
lea ecx, [esp + 0x174]
mov dword [esp + 0x184], 0
mov byte [esp + 0x174], 0
push 8
push 0x425bd4
call fcn.00407b40
sub esp, 0xc
mov byte [esp + 0x3bc], 3
lea eax, [esp + 0x1e0]
lea ecx, [esp + 0x298]
push eax
lea eax, [esp + 0x184]
push eax
call fcn.00403fa0
mov byte [esp + 0x3b0], 5
cmp dword [esp + 0x188], 0x10
jb 0x404a37
push dword [esp + 0x174]
call fcn.0040a00c
add esp, 4
cmp byte [esp + 0x28c], 0
mov dword [esp + 0x188], 0xf
mov dword [esp + 0x184], 0
mov byte [esp + 0x174], 0
jne 0x404a9e
nop
push 0
push 0
push 0
lea eax, [esp + 0x1ac]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x404a94
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp byte [esp + 0x28c], 0
je 0x404a60
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x2a8]
push eax
lea ecx, [esp + 0x1e0]
call fcn.00407a10
push 0x78
call esi
test ax, ax
je 0x404acd
nop
push 1
call edi
push 0x78
call esi
test ax, ax
jne 0x404ac0
lea ecx, [esp + 0x28c]
mov byte [esp + 0x3b0], 2
call fcn.004042a0
push 0x79
call esi
test ax, ax
je 0x404c23
push 0x78
lea eax, [esp + 0x218]
push 0
push eax
call fcn.0040ddc0
add esp, 0xc
mov dword [esp + 0x188], 0xf
lea ecx, [esp + 0x174]
mov dword [esp + 0x184], 0
mov byte [esp + 0x174], 0
push 8
push 0x425be0
call fcn.00407b40
sub esp, 0xc
mov byte [esp + 0x3bc], 6
lea eax, [esp + 0x1f8]
lea ecx, [esp + 0x220]
push eax
lea eax, [esp + 0x184]
push eax
call fcn.00403fa0
mov byte [esp + 0x3b0], 8
cmp dword [esp + 0x188], 0x10
jb 0x404b7b
push dword [esp + 0x174]
call fcn.0040a00c
add esp, 4
cmp byte [esp + 0x214], 0
mov dword [esp + 0x188], 0xf
mov dword [esp + 0x184], 0
mov byte [esp + 0x174], 0
jne 0x404be1
push 0
push 0
push 0
lea eax, [esp + 0x1ac]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x404bd7
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp byte [esp + 0x214], 0
je 0x404ba3
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x1f8]
call fcn.00407a10
push 0x79
call esi
test ax, ax
je 0x404c0f
push 1
call edi
push 0x79
call esi
test ax, ax
jne 0x404c02
lea ecx, [esp + 0x214]
mov byte [esp + 0x3b0], 2
call fcn.004042a0
push str.League_of_Legends
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x404ce9
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
sete al
test al, al
je 0x404ce9
mov ecx, dword [0x42ba90]
mov eax, 5
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push str.League_of_Legends__TM__Client
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x404c8c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
sete al
test al, al
jne 0x404906
push str.League_of_Legends
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x404d04
lea ecx, [esp + 0x204]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x404d04
mov ecx, dword [esp + 0x20c]
mov edx, dword [esp + 0x204]
sub ecx, edx
mov eax, dword [esp + 0x210]
mov esi, dword [esp + 0x208]
sub eax, esi
mov dword [0x42ba70], edx
mov dword [0x42ba74], esi
mov dword [0x42ba78], ecx
mov dword [0x42ba7c], eax
jmp 0x404d1b
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x42ba90]
cmp ecx, eax
je 0x404c53
xor eax, eax
jmp 0x404c58
xorps xmm0, xmm0
movdqa xmmword [0x42ba70], xmm0
mov esi, dword [0x42ba74]
mov edx, dword [0x42ba70]
cmp edx, 0x140
jne 0x404d2b
cmp esi, 0xa0
je 0x404d86
push str.League_of_Legends
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x404d86
lea eax, [esp + 0x174]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [esp + 0x17c]
mov ecx, 5
cmp eax, 2
jne 0x404d63
lea ecx, [eax + 0x53]
jmp 0x404d6e
cmp eax, 3
mov eax, 0x15
cmove ecx, eax
push ecx
push 0
push 0
push 0xa0
push 0x140
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425ed0]
lea eax, [esp + 0x1b8]
push eax
lea eax, [esp + 0x1a8]
mov dword [esp + 0x1b8], 0xd0
push eax
push 0
lea ecx, [esp + 0x58]
mov dword [esp + 0x58], 0
movdqu xmmword [esp + 0x1b0], xmm0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
call fcn.00409410
mov byte [esp + 0x3b0], 9
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x10]
or edx, 1
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 4]
imul ecx, dword [0x42ba18]
mov dword [esp + 0x18], edx
add ecx, dword [esi]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [esi + 0x10]
jne 0x404ef5
movzx eax, byte [ecx + 1]
cmp eax, dword [esi + 0xc]
jne 0x404ef5
movzx eax, byte [ecx + 2]
cmp eax, dword [esi + 8]
jne 0x404ef5
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e20]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x79
push eax
push 0
lea ecx, [esp + 0x70]
mov dword [esp + 0x70], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], 0
call fcn.00409410
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x60]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
or edx, 2
mov ecx, dword [eax + 4]
imul ecx, dword [0x42ba18]
mov dword [esp + 0x10], edx
add ecx, dword [eax]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [esi + 0x10]
mov esi, dword [esp + 0x48]
jne 0x404eea
mov esi, dword [esp + 0x20]
movzx eax, byte [ecx + 1]
cmp eax, dword [esi + 0xc]
mov esi, dword [esp + 0x48]
jne 0x404edf
movzx eax, byte [ecx + 2]
mov ecx, dword [esp + 0x20]
cmp eax, dword [ecx + 8]
je 0x404ef9
mov byte [esp + 0xf], 1
jmp 0x404efe
mov ecx, dword [esp + 0x20]
mov byte [esp + 0xf], 1
jmp 0x404efe
mov ecx, dword [esp + 0x60]
mov byte [esp + 0xf], 1
jmp 0x404efe
mov ecx, dword [esp + 0x20]
mov byte [esp + 0xf], 0
test dl, 2
je 0x404f33
and edx, 0xfffffffd
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x404f33
push ecx
call fcn.0040a00c
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x20], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x3b0], 2
test dl, 1
je 0x404f6b
and edx, 0xfffffffe
push esi
mov dword [esp + 0x14], edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
cmp byte [esp + 0xf], 0
je 0x404fc2
push str.League_of_Legends
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, eax
test esi, esi
je 0x404900
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
sete al
test al, al
je 0x404906
mov edx, 0x348
lea ecx, [edx + 0xa]
call fcn.00403940
push 8
push 0x425c20
lea ecx, [esp + 0x1c4]
call fcn.00407b40
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425f20]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0xd2
push eax
push 0
lea ecx, [esp + 0x118]
mov dword [esp + 0x118], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x11c], 0
mov dword [esp + 0x120], 0
call fcn.00409410
mov edx, dword [esp + 0x108]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x40505c
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x40505c
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x405061
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x108], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0x10c], 0
mov dword [esp + 0x110], 0
je 0x405283
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e30]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x57
push eax
push 0
lea ecx, [esp + 0xdc]
mov dword [esp + 0xdc], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0xe0], 0
mov dword [esp + 0xe4], 0
call fcn.00409410
mov edx, dword [esp + 0xcc]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x405132
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x405132
movzx eax, byte [ecx + 2]
cmp eax, dword [edx + 8]
jne 0x405132
mov eax, 1
jmp 0x405134
xor eax, eax
test al, al
push edx
sete byte [esp + 0x13]
call fcn.0040a00c
add esp, 4
mov dword [esp + 0xcc], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 0
je 0x405283
mov esi, 0x14
jmp 0x405180
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e30]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x57
push eax
push 0
lea ecx, [esp + 0xac]
mov dword [esp + 0xac], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0
call fcn.00409410
mov edx, dword [esp + 0x9c]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x40521c
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x40521c
movzx eax, byte [ecx + 2]
cmp eax, dword [edx + 8]
jne 0x40521c
mov eax, 1
jmp 0x40521e
xor eax, eax
test al, al
push edx
sete byte [esp + 0x13]
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x9c], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
je 0x405278
mov edx, 0x2c6
mov ecx, 0x3b6
call fcn.00403940
push 4
push 0x425c2c
lea ecx, [esp + 0x1c4]
call fcn.00407b40
push 0x64
call edi
dec esi
jne 0x405180
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e70]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0xa6
push eax
push 0
lea ecx, [esp + 0xd0]
mov dword [esp + 0xd0], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0xd4], 0
mov dword [esp + 0xd8], 0
call fcn.00409410
mov edx, dword [esp + 0xc0]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x40531d
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x40531d
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x405322
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0xc0], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0xc4], 0
mov dword [esp + 0xc8], 0
je 0x405556
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e40]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x57
push eax
push 0
lea ecx, [esp + 0xc4]
mov dword [esp + 0xc4], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0xc8], 0
mov dword [esp + 0xcc], 0
call fcn.00409410
mov edx, dword [esp + 0xb4]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x4053f1
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x4053f1
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x4053f6
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0xb4], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0xbc], 0
je 0x4054fe
movdqa xmm0, xmmword [0x425e10]
lea eax, [esp + 0x19c]
sub esp, 0xc
mov dword [esp + 0x1a0], 0x69
mov ecx, esp
mov dword [esp + 0x1a4], 0x62
movdqu xmmword [esp + 0x180], xmm0
push dword [esp + 0x20]
movdqa xmm0, xmmword [0x425e50]
push eax
lea eax, [esp + 0x188]
movdqu xmmword [esp + 0x198], xmm0
push eax
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.00409410
mov edx, 0x42ba4c
mov ecx, 0x42ba48
call fcn.00403e40
add esp, 0xc
test al, al
jne 0x4054ed
mov edx, 0x108
mov ecx, 0x43a
call fcn.00403940
mov edx, 0x1e
call fcn.00403af0
mov edx, 0x2d
call fcn.00403af0
lea ecx, [esp + 0x1ec]
call fcn.00404750
mov edx, 0x2f
call fcn.00403af0
push 0x258
jmp 0x405554
mov edx, 0x140
mov ecx, 0x2bc
call fcn.00403940
jmp 0x40554f
mov edx, 0x2fe
mov ecx, 0x3c7
call fcn.00403940
lea eax, [esp + 0x1ec]
mov edx, 0x425c34
push eax
lea ecx, [esp + 0x178]
call fcn.00408840
add esp, 4
lea ecx, [esp + 0x1bc]
push eax
call fcn.00406a70
cmp dword [esp + 0x188], 0x10
jb 0x40554f
push dword [esp + 0x174]
call fcn.0040a00c
add esp, 4
push 0x12c
call edi
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425ea0]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0xbe
push eax
push 0
lea ecx, [esp + 0x100]
mov dword [esp + 0x100], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x104], 0
mov dword [esp + 0x108], 0
call fcn.00409410
mov edx, dword [esp + 0xf0]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x4055f0
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x4055f0
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x4055f5
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0xf0], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0xf4], 0
mov dword [esp + 0xf8], 0
je 0x405820
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e40]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x57
push eax
push 0
lea ecx, [esp + 0x88]
mov dword [esp + 0x88], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
call fcn.00409410
mov edx, dword [esp + 0x78]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x4056c1
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x4056c1
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x4056c6
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x78], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
je 0x4057c8
movdqa xmm0, xmmword [0x425e10]
lea eax, [esp + 0x19c]
sub esp, 0xc
mov dword [esp + 0x1a0], 0x69
mov ecx, esp
mov dword [esp + 0x1a4], 0x62
movdqu xmmword [esp + 0x180], xmm0
push dword [esp + 0x20]
movdqa xmm0, xmmword [0x425e50]
push eax
lea eax, [esp + 0x188]
movdqu xmmword [esp + 0x198], xmm0
push eax
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.00409410
mov edx, 0x42ba4c
mov ecx, 0x42ba48
call fcn.00403e40
add esp, 0xc
test al, al
jne 0x4057b7
mov edx, 0x108
mov ecx, 0x43a
call fcn.00403940
mov edx, 0x1e
call fcn.00403af0
mov edx, 0x2d
call fcn.00403af0
lea ecx, [esp + 0x1d4]
call fcn.00404750
mov edx, 0x2f
call fcn.00403af0
push 0x258
jmp 0x40581e
mov edx, 0x140
mov ecx, 0x2bc
call fcn.00403940
jmp 0x405819
mov edx, 0x2fe
mov ecx, 0x3c7
call fcn.00403940
lea eax, [esp + 0x1d4]
mov edx, 0x425c3c
push eax
lea ecx, [esp + 0x178]
call fcn.00408840
add esp, 4
lea ecx, [esp + 0x1bc]
push eax
call fcn.00406a70
cmp dword [esp + 0x188], 0x10
jb 0x405819
push dword [esp + 0x174]
call fcn.0040a00c
add esp, 4
push 0x12c
call edi
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425ec0]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0xd0
push eax
push 0
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call fcn.00409410
mov byte [esp + 0x3b0], 0xa
mov esi, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
or edx, 4
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 4]
imul ecx, dword [0x42ba18]
mov dword [esp + 0x18], edx
add ecx, dword [esi]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [esi + 0x10]
jne 0x40597f
movzx eax, byte [ecx + 1]
cmp eax, dword [esi + 0xc]
jne 0x40597f
movzx eax, byte [ecx + 2]
cmp eax, dword [esi + 8]
jne 0x40597f
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e90]
lea eax, [esp + 0x1b8]
push eax
lea eax, [esp + 0x1a8]
mov dword [esp + 0x1b8], 0x91
push eax
push 0
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0
movdqu xmmword [esp + 0x1b0], xmm0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.00409410
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
or edx, 8
mov ecx, dword [eax + 4]
imul ecx, dword [0x42ba18]
mov dword [esp + 0x10], edx
add ecx, dword [eax]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [esi + 0x10]
mov esi, dword [esp + 0x3c]
jne 0x405979
mov esi, dword [esp + 0x1c]
movzx eax, byte [ecx + 1]
cmp eax, dword [esi + 0xc]
mov esi, dword [esp + 0x3c]
jne 0x40597f
movzx eax, byte [ecx + 2]
mov ecx, dword [esp + 0x1c]
cmp eax, dword [ecx + 8]
jne 0x405983
mov byte [esp + 0xf], 1
jmp 0x405988
mov ecx, dword [esp + 0x30]
jmp 0x405983
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0xf], 0
test dl, 8
je 0x4059bd
and edx, 0xfffffff7
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x4059bd
push ecx
call fcn.0040a00c
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x1c], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3b0], 2
test dl, 4
je 0x4059f5
and edx, 0xfffffffb
push esi
mov dword [esp + 0x14], edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
cmp byte [esp + 0xf], 0
je 0x405a20
mov edx, 0x348
lea ecx, [edx + 0xa]
call fcn.00403940
push 0x64
call edi
push 4
push 0x425c44
lea ecx, [esp + 0x1c4]
call fcn.00407b40
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425f00]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0xd2
push eax
push 0
lea ecx, [esp + 0xe8]
mov dword [esp + 0xe8], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0xec], 0
mov dword [esp + 0xf0], 0
call fcn.00409410
mov edx, dword [esp + 0xd8]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x405aba
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x405aba
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x405abf
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0xd8], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0xdc], 0
mov dword [esp + 0xe0], 0
je 0x405b16
mov edx, 0x329
mov ecx, 0x3bf
call fcn.00403940
push 4
push 0x425c4c
lea ecx, [esp + 0x1c4]
call fcn.00407b40
push 0x64
call edi
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e80]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x91
push eax
push 0
lea ecx, [esp + 0xf4]
mov dword [esp + 0xf4], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0xf8], 0
mov dword [esp + 0xfc], 0
call fcn.00409410
mov edx, dword [esp + 0xe4]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x405bb0
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x405bb0
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x405bb5
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0xe4], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0
je 0x405c0a
mov edx, 0x349
lea ecx, [edx + 3]
call fcn.00403940
push 8
push 0x425c54
lea ecx, [esp + 0x1c4]
call fcn.00407b40
push 0x64
call edi
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425ef0]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0xd2
push eax
push 0
lea ecx, [esp + 0x130]
mov dword [esp + 0x130], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x134], 0
mov dword [esp + 0x138], 0
call fcn.00409410
mov edx, dword [esp + 0x120]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x405ca4
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x405ca4
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x405ca9
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x120], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0x124], 0
mov dword [esp + 0x128], 0
je 0x405eba
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e60]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x8c
push eax
push 0
lea ecx, [esp + 0x10c]
mov dword [esp + 0x10c], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], 0
call fcn.00409410
mov edx, dword [esp + 0xfc]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x405d78
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x405d78
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x405d7d
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0xfc], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0
je 0x405eba
mov esi, 0x14
jmp 0x405dc0
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e60]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x8c
push eax
push 0
lea ecx, [esp + 0x148]
mov dword [esp + 0x148], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x14c], 0
mov dword [esp + 0x150], 0
call fcn.00409410
mov edx, dword [esp + 0x138]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x405e5a
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x405e5a
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x405e5f
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x138], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0x13c], 0
mov dword [esp + 0x140], 0
je 0x405e9c
mov edx, 0x348
mov ecx, edx
call fcn.00403940
push 0x64
call edi
dec esi
jne 0x405dc0
push 8
push 0x425c60
lea ecx, [esp + 0x1c4]
call fcn.00407b40
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425eb0]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0xcf
push eax
push 0
lea ecx, [esp + 0x124]
mov dword [esp + 0x124], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x128], 0
mov dword [esp + 0x12c], 0
call fcn.00409410
mov edx, dword [esp + 0x114]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x405f54
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x405f54
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x405f59
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x114], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0x118], 0
mov dword [esp + 0x11c], 0
je 0x40616a
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e60]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x8c
push eax
push 0
lea ecx, [esp + 0x13c]
mov dword [esp + 0x13c], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x140], 0
mov dword [esp + 0x144], 0
call fcn.00409410
mov edx, dword [esp + 0x12c]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x406028
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x406028
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x40602d
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x12c], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0x130], 0
mov dword [esp + 0x134], 0
je 0x406157
mov esi, 0x14
jmp 0x406070
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425e60]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0x8c
push eax
push 0
lea ecx, [esp + 0x94]
mov dword [esp + 0x94], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
call fcn.00409410
mov edx, dword [esp + 0x84]
mov ecx, dword [edx + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edx]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edx + 0x10]
jne 0x40610a
movzx eax, byte [ecx + 1]
cmp eax, dword [edx + 0xc]
jne 0x40610a
movzx eax, byte [ecx + 2]
mov byte [esp + 0xf], 1
cmp eax, dword [edx + 8]
je 0x40610f
mov byte [esp + 0xf], 0
push edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x84], 0
cmp byte [esp + 0xf], 0
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
je 0x40614c
mov edx, 0x348
mov ecx, edx
call fcn.00403940
push 0x64
call edi
dec esi
jne 0x406070
push 4
push 0x425c6c
lea ecx, [esp + 0x1c4]
call fcn.00407b40
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425f10]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0xd2
push eax
push 0
lea ecx, [esp + 0xb8]
mov dword [esp + 0xb8], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc0], 0
call fcn.00409410
mov byte [esp + 0x3b0], 0xb
mov esi, dword [esp + 0xa8]
mov edx, dword [esp + 0x10]
or edx, 0x10
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 4]
imul ecx, dword [0x42ba18]
mov dword [esp + 0x18], edx
add ecx, dword [esi]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [esi + 0x10]
jne 0x40621a
movzx eax, byte [ecx + 1]
cmp eax, dword [esi + 0xc]
jne 0x40621a
movzx eax, byte [ecx + 2]
cmp eax, dword [esi + 8]
je 0x4064aa
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425ee0]
lea eax, [esp + 0x1b8]
push eax
lea eax, [esp + 0x1a8]
mov dword [esp + 0x1b8], 0xd0
push eax
push 0
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa0], 0
movdqu xmmword [esp + 0x1b0], xmm0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
call fcn.00409410
mov edi, dword [esp + 0x90]
mov edx, dword [esp + 0x10]
or edx, 0x20
mov dword [esp + 0x28], edi
mov dword [esp + 0x10], edx
mov ecx, dword [edi + 4]
imul ecx, dword [0x42ba18]
add ecx, dword [edi]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [edi + 0x10]
jne 0x4062c2
movzx eax, byte [ecx + 1]
cmp eax, dword [edi + 0xc]
jne 0x4062c2
movzx eax, byte [ecx + 2]
cmp eax, dword [edi + 8]
je 0x4064ae
mov byte [esp + 0xf], 0
test dl, 0x20
je 0x4062f8
and edx, 0xffffffdf
mov dword [esp + 0x10], edx
test edi, edi
je 0x4062f8
push edi
call fcn.0040a00c
mov edx, dword [esp + 0x14]
add esp, 4
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x3b0], 2
test dl, 0x10
je 0x406339
and edx, 0xffffffef
push esi
mov dword [esp + 0x14], edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0
mov dword [esp + 0xb0], 0
cmp byte [esp + 0xf], 0
je 0x406577
mov edi, 0xa
lea esp, [esp]
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425f10]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0x18c], 0xd2
push eax
push 0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x7c], 0
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0
call fcn.00409410
mov byte [esp + 0x3b0], 0xc
mov esi, dword [esp + 0x6c]
mov edx, dword [esp + 0x10]
or edx, 0x40
mov dword [esp + 0x10], edx
mov ecx, dword [esi + 4]
imul ecx, dword [0x42ba18]
mov dword [esp + 0x18], edx
add ecx, dword [esi]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [esi + 0x10]
jne 0x4063f7
movzx eax, byte [ecx + 1]
cmp eax, dword [esi + 0xc]
jne 0x4063f7
movzx eax, byte [ecx + 2]
cmp eax, dword [esi + 8]
je 0x4064b8
push dword [esp + 0x14]
movdqa xmm0, xmmword [0x425ee0]
lea eax, [esp + 0x1b8]
push eax
lea eax, [esp + 0x1a8]
mov dword [esp + 0x1b8], 0xd0
push eax
push 0
lea ecx, [esp + 0x64]
mov dword [esp + 0x64], 0
movdqu xmmword [esp + 0x1b0], xmm0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
call fcn.00409410
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0x54]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
or edx, 0x80
mov ecx, dword [eax + 4]
imul ecx, dword [0x42ba18]
mov dword [esp + 0x10], edx
add ecx, dword [eax]
shl ecx, 2
add ecx, dword [0x42ba20]
movzx eax, byte [ecx]
cmp eax, dword [esi + 0x10]
mov esi, dword [esp + 0x6c]
jne 0x4064c9
mov esi, dword [esp + 0x24]
movzx eax, byte [ecx + 1]
cmp eax, dword [esi + 0xc]
mov esi, dword [esp + 0x6c]
jne 0x4064c3
movzx eax, byte [ecx + 2]
mov ecx, dword [esp + 0x24]
cmp eax, dword [ecx + 8]
jne 0x4064cd
mov byte [esp + 0xf], 1
jmp 0x4064d2
mov edi, dword [esp + 0x28]
mov byte [esp + 0xf], 1
jmp 0x4062c7
mov ecx, dword [esp + 0x24]
mov byte [esp + 0xf], 1
jmp 0x4064d2
mov ecx, dword [esp + 0x24]
jmp 0x4064cd
mov ecx, dword [esp + 0x54]
mov byte [esp + 0xf], 0
test dl, dl
jns 0x406509
and edx, 0xffffff7f
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x406509
push ecx
call fcn.0040a00c
mov edx, dword [esp + 0x14]
add esp, 4
mov dword [esp + 0x24], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x3b0], 2
test dl, 0x40
je 0x406541
and edx, 0xffffffbf
push esi
mov dword [esp + 0x14], edx
call fcn.0040a00c
add esp, 4
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
cmp byte [esp + 0xf], 0
je 0x406555
mov edx, 0x348
lea ecx, [edx + 0x78]
call fcn.00403940
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
dec edi
jne 0x406350
push 2
push 0x425c74
lea ecx, [esp + 0x1c4]
call fcn.00407b40
push 0x98
lea eax, [esp + 0x308]
push 0
push eax
call fcn.0040ddc0
add esp, 4
lea ecx, [esp + 0x30c]
call fcn.004075b0
lea eax, [esp + 0x1d4]
mov byte [esp + 0x3b0], 0xd
push eax
mov edx, str.e_32_1m
lea ecx, [esp + 0x1a4]
call fcn.00408840
add esp, 4
push str.e_0m
mov edx, eax
mov byte [esp + 0x3b4], 0xe
lea ecx, [esp + 0x178]
call fcn.004087a0
add esp, 4
mov dword [esp + 0x18], eax
push 0
lea eax, [esp + 0x148]
mov byte [esp + 0x3b4], 0xf
push 0x14
push eax
call fcn.00409995
add esp, 0xc
lea ecx, [esp + 0x304]
mov edx, str.F9
mov edi, eax
call fcn.00408a20
mov esi, eax
test esi, esi
jne 0x406619
xor ecx, ecx
jmp 0x406620
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
push dword [edi + 0xc]
mov eax, dword [edi]
push dword [edi + 8]
push ecx
call eax
add esp, 0xc
test esi, esi
jne 0x406636
xor ecx, ecx
jmp 0x40663d
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 0x18]
and eax, 0xfffffe7f
or eax, 0x40
mov dword [ecx + 0x14], eax
mov ecx, esi
call fcn.00408d30
push eax
call fcn.00408fb0
add esp, 4
cmp dword [esp + 0x188], 0x10
jb 0x406678
push dword [esp + 0x174]
call fcn.0040a00c
add esp, 4
mov byte [esp + 0x3b0], 0xd
cmp dword [esp + 0x1b4], 0x10
mov dword [esp + 0x188], 0xf
mov dword [esp + 0x184], 0
mov byte [esp + 0x174], 0
jb 0x4066b7
push dword [esp + 0x1a0]
call fcn.0040a00c
add esp, 4
lea eax, [esp + 0x1ec]
mov edx, str.e_32_1m
push eax
lea ecx, [esp + 0x1a4]
call fcn.00408840
add esp, 4
push str.e_0m
mov edx, eax
mov byte [esp + 0x3b4], 0x10
lea ecx, [esp + 0x178]
call fcn.004087a0
add esp, 4
mov dword [esp + 0x18], eax
push 0
lea eax, [esp + 0x168]
mov byte [esp + 0x3b4], 0x11
push 0x14
push eax
call fcn.00409995
add esp, 0xc
lea ecx, [esp + 0x304]
mov edx, str.F10
mov edi, eax
call fcn.00408a20
mov esi, eax
test esi, esi
jne 0x40672e
xor ecx, ecx
jmp 0x406735
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
push dword [edi + 0xc]
mov eax, dword [edi]
push dword [edi + 8]
push ecx
call eax
add esp, 0xc
test esi, esi
jne 0x40674b
xor ecx, ecx
jmp 0x406752
mov eax, dword [esi]
mov ecx, dword [eax + 4]
add ecx, esi
mov eax, dword [ecx + 0x14]
mov edx, dword [esp + 0x18]
and eax, 0xfffffe7f
or eax, 0x40
mov dword [ecx + 0x14], eax
mov ecx, esi
call fcn.00408d30
push eax
call fcn.00408fb0
mov eax, dword [esp + 0x18c]
add esp, 4
cmp eax, 0x10
jb 0x4067a1
inc eax
lea ecx, [esp + 0x174]
push eax
push dword [esp + 0x178]
lea eax, [esp + 0x37]
push eax
call fcn.00407dd0
mov ecx, eax
call fcn.00408240
push 0
lea ecx, [esp + 0x178]
mov dword [esp + 0x18c], 0xf
call fcn.00407ce0
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x3b0], 0xd
call fcn.00406af0
lea eax, [esp + 0x1bc]
mov edx, str.e_35_1m
push eax
lea ecx, [esp + 0x1a4]
call fcn.00408840
add esp, 4
push str.e_0m
mov edx, eax
mov byte [esp + 0x3b4], 0x12
lea ecx, [esp + 0x178]
call fcn.004087a0
mov edi, eax
sub esp, 0xc
mov byte [esp + 0x3c0], 0x13
lea eax, [esp + 0x164]
push 0
push 0x1e
push eax
call fcn.00409995
add esp, 8
lea ecx, [esp + 0x318]
mov esi, eax
call fcn.00406ed0
mov edx, 0x425cb0
mov ecx, eax
call fcn.00408a20
mov edx, esi
mov ecx, eax
call fcn.00408cf0
add esp, 4
mov ecx, eax
call fcn.00406ee0
mov edx, edi
mov ecx, eax
call fcn.00408d30
add esp, 4
mov ecx, eax
call fcn.00406ed0
lea ecx, [esp + 0x174]
call fcn.00406af0
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x3b0], 0xd
call fcn.00406af0
xor eax, eax
push eax
push 0xfffffffffffffff5
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea eax, [esp + 0x174]
push eax
lea ecx, [esp + 0x308]
call fcn.00407680
mov ecx, eax
call fcn.00406b20
push eax
call fcn.0040abdf
add esp, 4
lea ecx, [esp + 0x174]
call fcn.00406af0
lea ecx, [esp + 0x304]
mov byte [esp + 0x3b0], 2
call fcn.00406940
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x404900
lea ecx, [esp + 0x1bc]
call fcn.00406af0
lea ecx, [esp + 0x1ec]
call fcn.00406af0
lea ecx, [esp + 0x1d4]
call fcn.00406af0
xor eax, eax
mov ecx, dword [esp + 0x3a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x394]
xor ecx, esp
call fcn.0040a011
mov esp, ebp
pop ebp
ret