Function at 0x4c35b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x92f24a
push eax
mov eax, 0x114c
mov dword fs:[0], esp
call fcn.009129f0
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
call fcn.00911f0c
xor ebx, ebx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1160], ebx
call fcn.00911f0c
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1160], 1
call fcn.00911f0c
lea ecx, [esp + 0xc]
mov byte [esp + 0x1160], 2
call fcn.00911f0c
lea ecx, [esp + 0x30]
mov byte [esp + 0x1160], 3
call fcn.00911f0c
lea ecx, [esp + 0x38]
mov byte [esp + 0x1160], 4
call fcn.00911f0c
lea ecx, [esp + 0x84]
mov byte [esp + 0x1160], 5
call fcn.00911f0c
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1160], 6
call fcn.00911f0c
lea ecx, [esp + 0x74]
mov byte [esp + 0x1160], 7
call fcn.00911f0c
lea ecx, [esp + 0x6c]
mov byte [esp + 0x1160], 8
call fcn.00911f0c
lea ecx, [esp + 0x64]
mov byte [esp + 0x1160], 9
call fcn.00911f0c
lea ecx, [esp + 0x50]
mov byte [esp + 0x1160], 0xa
call fcn.00911f0c
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1160], 0xb
call fcn.00911f0c
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1160], 0xc
call fcn.00911f0c
lea ecx, [esp + 0x54]
mov byte [esp + 0x1160], 0xd
call fcn.00911f0c
lea ecx, [esp + 0x58]
mov byte [esp + 0x1160], 0xe
call fcn.00911f0c
lea ecx, [esp + 0x60]
mov byte [esp + 0x1160], 0xf
call fcn.00911f0c
mov byte [esp + 0x1160], 0x10
mov dword [esp + 0x48], ebx
push ebx
lea ecx, [esp + 0x89c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
call fcn.00735050
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1160], 0x11
mov dword [esp + 0x14], ebx
call fcn.00911f24
lea ecx, [esp + 0x9c]
mov byte [esp + 0x1160], 0x12
call fcn.00911f12
lea ecx, [esp + 0xac]
mov byte [esp + 0x1160], 0x13
call fcn.00911f0c
push ebx
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1164], 0x14
mov dword [esp + 0xa0], 0x9ca970
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], 0xffffffff
call fcn.00911f06
lea eax, [esp + 0x18]
mov ecx, 0xa903c8
push eax
mov byte [esp + 0x1164], 0x15
call fcn.009121e2
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x1164], 0x16
call fcn.00911f3c
lea ecx, [esp + 0x18]
mov byte [esp + 0x1160], 0x15
call fcn.00911ee2
lea ecx, [esp + 0x30]
call fcn.009121b2
mov eax, dword [0xa8e874]
mov edi, 0xa763f0
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x4c37fe
test cl, cl
je 0x4c37fa
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x4c37fe
add eax, 2
add edi, 2
test cl, cl
jne 0x4c37da
xor eax, eax
jmp 0x4c3803
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
push 0xa907a4
jne 0x4c3813
push str..QDA
jmp 0x4c3818
push str..QDJ
lea ecx, [esp + 0x38]
call fcn.009121a0
push ebx
lea ecx, [esp + 0xd4]
call fcn.008a2190
mov bl, 0x17
push 0xa763f0
lea ecx, [esp + 0x140]
mov byte [esp + 0x1164], bl
call fcn.00911f06
lea eax, [esp + 0x30]
lea ecx, [esp + 0x134]
push eax
call fcn.00911f3c
push 0xa76abc
lea ecx, [esp + 0x2c]
push 0xa8e85c
push ecx
call fcn.009121dc
push 0xa8e87c
lea edx, [esp + 0x38]
push eax
push edx
mov byte [esp + 0x116c], 0x18
call fcn.009121d6
push 0xa76abc
push eax
lea eax, [esp + 0x20]
mov byte [esp + 0x1168], 0x19
push eax
call fcn.009121dc
mov eax, dword [eax]
push 0xa907a4
push eax
lea ecx, [esp + 0x13c]
mov byte [esp + 0x1168], 0x1a
call fcn.009121a0
lea ecx, [esp + 0x18]
mov byte [esp + 0x1160], 0x19
call fcn.00911ee2
lea ecx, [esp + 0x34]
mov byte [esp + 0x1160], 0x18
call fcn.00911ee2
lea ecx, [esp + 0x28]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
lea ecx, [esp + 0xd0]
call fcn.008a5390
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x38]
push ecx
push str._s.QTX
push edx
call fcn.00911f42
add esp, 8
lea eax, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.0091203e
lea ecx, [esp + 0x89c]
call fcn.007351b0
test eax, eax
je 0x4c425d
mov ecx, dword [0xa8e570]
mov edi, dword [ebp + 8]
mov dword [esi + 0x23f0], ecx
mov eax, ecx
mov edx, dword [edi]
push eax
mov ecx, edi
call dword [edx + 0x38]
mov edx, dword [edi]
push 4
mov ecx, edi
call dword [edx + 0x3c]
mov eax, dword [edi + 8]
push 6
push eax
nop
call int.00b15556
push eax
call fcn.00912368
lea ecx, [esi + 0x2198]
mov dword [esi + 0x2194], eax
mov edx, dword [eax + 4]
push ecx
push 0x3c
push edx
nop
call fcn.00b1555f
cmp dword [0xa8fd14], 3
je 0x4c39d9
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x9c]
push eax
push 0
push ecx
lea ecx, [esp + 0xc0]
call fcn.00912068
test eax, eax
jne 0x4c39c4
push ecx
lea edx, [esp + 0x3c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.0091203e
lea ecx, [esp + 0x89c]
call fcn.007355a0
mov eax, dword [esp + 0xb4]
push 0
push 0
lea ecx, [esp + 0xbc]
call dword [eax + 0x30]
mov ecx, dword [esp + 0x48]
mov eax, dword [esi + 0x9cc]
push ecx
lea edx, [esp + 0x18]
push eax
push edx
push edi
mov ecx, esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x44], 0
call fcn.004c64e0
mov eax, dword [esp + 0xb4]
push 0
push 0
lea ecx, [esp + 0xbc]
call dword [eax + 0x30]
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xb8]
call fcn.00912062
test eax, eax
je 0x4c4034
push 0
push 0x2c
lea ecx, [esp + 0x14]
call fcn.009121a6
lea edx, [esp + 0x94]
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.00912044
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x1164], 0x1b
call fcn.00911f3c
lea ecx, [esp + 0x94]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
lea eax, [esp + 0x10]
lea ecx, [esp + 0x50]
push eax
call fcn.00911f3c
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x10]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x90]
sub edx, ecx
lea ecx, [esp + 0xc]
dec edx
push edx
push eax
call fcn.0091218e
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1164], 0x1c
call fcn.00911f3c
lea ecx, [esp + 0x90]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
push 0
push 0x2c
lea ecx, [esp + 0x14]
call fcn.009121a6
lea ecx, [esp + 0x68]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00912044
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x1164], 0x1d
call fcn.00911f3c
lea ecx, [esp + 0x68]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
lea edx, [esp + 0x10]
lea ecx, [esp + 0x4c]
push edx
call fcn.00911f3c
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x10]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
lea eax, [esp + 0x70]
dec edx
lea ecx, [esp + 0xc]
push edx
push eax
call fcn.0091218e
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1164], 0x1e
call fcn.00911f3c
lea ecx, [esp + 0x70]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
push 0
push 0x2c
lea ecx, [esp + 0x14]
call fcn.009121a6
lea ecx, [esp + 0xcc]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00912044
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x1164], 0x1f
call fcn.00911f3c
push eax
lea ecx, [esp + 0x14]
call fcn.00911f3c
lea ecx, [esp + 0xcc]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
lea edx, [esp + 0x10]
lea ecx, [esp + 0x5c]
push edx
call fcn.00911f3c
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x2c]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x78]
sub edx, ecx
lea ecx, [esp + 0xc]
dec edx
push edx
push eax
call fcn.0091218e
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1164], 0x20
call fcn.00911f3c
lea ecx, [esp + 0x78]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
push 0
push 0x2c
lea ecx, [esp + 0x14]
call fcn.009121a6
lea ecx, [esp + 0x98]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00912044
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x1164], 0x21
call fcn.00911f3c
push eax
lea ecx, [esp + 0x14]
call fcn.00911f3c
lea ecx, [esp + 0x98]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
lea edx, [esp + 0x10]
lea ecx, [esp + 0x54]
push edx
call fcn.00911f3c
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x2c]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x80]
sub edx, ecx
lea ecx, [esp + 0xc]
dec edx
push edx
push eax
call fcn.0091218e
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x1164], 0x22
call fcn.00911f3c
lea ecx, [esp + 0x80]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
push 0
push 0x2c
lea ecx, [esp + 0x14]
call fcn.009121a6
lea ecx, [esp + 0xc8]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00912044
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x1164], 0x23
call fcn.00911f3c
push eax
lea ecx, [esp + 0x14]
call fcn.00911f3c
lea ecx, [esp + 0xc8]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
lea edx, [esp + 0x10]
lea ecx, [esp + 0x58]
push edx
call fcn.00911f3c
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x2c]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x88]
sub edx, ecx
lea ecx, [esp + 0xc]
dec edx
push edx
push eax
call fcn.0091218e
mov byte [esp + 0x1160], 0x24
push eax
lea ecx, [esp + 0x10]
call fcn.00911f3c
lea ecx, [esp + 0x88]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
push 0
push 0x2c
lea ecx, [esp + 0x14]
call fcn.009121a6
lea ecx, [esp + 0xb0]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.00912044
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x1164], 0x25
call fcn.00911f3c
push eax
lea ecx, [esp + 0x14]
call fcn.00911f3c
lea ecx, [esp + 0xb0]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
lea edx, [esp + 0x10]
lea ecx, [esp + 0x60]
push edx
call fcn.00911f3c
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x4c4018
mov ecx, dword [0xa8e750]
mov edx, dword [esp + 0x28]
push 0
push 1
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x598]
sub ecx, eax
mov eax, dword [esi + 0x9cc]
push edx
cdq
mov edi, dword [ebp + 8]
sub eax, edx
sar eax, 1
add eax, ecx
mov dword [esp + 0x20], ecx
push eax
push edi
mov ecx, esi
call fcn.00460a00
mov al, byte [esi + 0x516]
test al, al
je 0x4c3e55
mov ecx, dword [esp + 0x50]
mov eax, dword [0xa8e758]
add eax, 3
mov edx, dword [ecx - 8]
mov dword [esp + 0x1c], edx
push dword [esp + 0x1c]
mov edx, dword [edi]
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x64]
mov al, byte [esi + 0x517]
test al, al
je 0x4c3e9b
mov eax, dword [esi + 0x9c8]
mov ecx, dword [esp + 0x4c]
imul eax, dword [esi + 0x734]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [esi + 0x5a4]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
mov dword [esp + 0x1c], edx
push dword [esp + 0x1c]
mov edx, dword [edi]
sub eax, 2
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x64]
mov al, byte [esi + 0x518]
test al, al
je 0x4c3ee1
mov eax, dword [esi + 0x9c8]
mov ecx, dword [esp + 0x54]
imul eax, dword [esi + 0x738]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [esi + 0x5a8]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
mov dword [esp + 0x1c], edx
push dword [esp + 0x1c]
mov edx, dword [edi]
sub eax, 2
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x64]
mov al, byte [esi + 0x519]
test al, al
je 0x4c3fe5
mov edx, dword [esp + 0x58]
push edx
nop
call fcn.00b15568
fstp qword [esp + 0x20]
add esp, 4
lea ecx, [esp + 0x64]
push 0xa780c4
call fcn.009121e8
cmp eax, 0xffffffff
jne 0x4c3f22
fld qword [esp + 0x3c]
fadd qword [esp + 0x1c]
fstp qword [esp + 0x3c]
jmp 0x4c3f32
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.008f5ce0
fcomp qword [0x9cb988]
fnstsw ax
test ah, 0x41
jne 0x4c3fe5
lea ecx, [esp + 0x18]
call fcn.00911f0c
mov ecx, dword [esi + 0x73c]
push 2
dec ecx
lea edx, [esp + 0x1c]
push ecx
push 0x25
push 0xa771b0
push edx
mov byte [esp + 0x1174], 0x26
call fcn.00911f42
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.00911f42
mov eax, dword [esi + 0x9c8]
add esp, 0x24
imul eax, dword [esi + 0x73c]
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
mov ecx, eax
mov eax, dword [esi + 0x5ac]
sar ecx, 1
sub eax, ecx
mov ecx, dword [edx - 8]
mov edx, dword [edi]
push ecx
mov ecx, dword [esp + 0x14]
sub eax, 2
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x64]
lea ecx, [esp + 0x18]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
mov edx, dword [0xa8e750]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add edx, ecx
sub eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
inc eax
mov dword [esp + 0x34], eax
push eax
push ecx
lea eax, [esp + 0x50]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edi
mov ecx, esi
call fcn.004c63e0
lea edx, [esp + 0xc]
lea ecx, [esp + 0xb4]
push edx
call fcn.00912062
test eax, eax
jne 0x4c3a2c
mov edi, dword [ebp + 8]
lea ecx, [esp + 0xb4]
call fcn.0091205c
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
mov ecx, esi
call fcn.008f5ce0
fcomp qword [0x9cb968]
fnstsw ax
test ah, 0x41
jne 0x4c4222
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
push edx
lea ecx, [esp + 0x4c]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
push edi
mov ecx, esi
call fcn.004c63e0
mov eax, dword [0xa8e750]
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x598]
add eax, ecx
mov ecx, dword [esp + 0x14]
push 0
sub ecx, eax
mov eax, dword [esi + 0x9cc]
push 1
push edx
cdq
sub eax, edx
mov dword [esp + 0x20], ecx
sar eax, 1
add eax, ecx
mov ecx, esi
push eax
push edi
call fcn.00460a00
mov eax, dword [edi]
lea ecx, [esi + 0x213c]
push ecx
mov ecx, edi
call dword [eax + 0x30]
mov al, byte [esi + 0x517]
test al, al
je 0x4c412e
push 0xa78208
lea ecx, [esp + 0x1c]
call fcn.00911edc
mov eax, dword [esi + 0x9c8]
mov ecx, dword [esp + 0x18]
imul eax, dword [esi + 0x734]
cdq
sub eax, edx
mov byte [esp + 0x1160], 0x27
mov edx, eax
mov eax, dword [esi + 0x5a4]
sar edx, 1
sub eax, edx
mov edx, dword [ecx - 8]
mov dword [esp + 0x1c], edx
push dword [esp + 0x1c]
mov edx, dword [edi]
sub eax, 2
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x64]
lea ecx, [esp + 0x18]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
mov al, byte [esi + 0x519]
test al, al
je 0x4c41f2
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
push edx
push eax
mov ecx, esi
call fcn.008f5ce0
fcomp qword [0x9cb968]
fnstsw ax
test ah, 0x41
jne 0x4c41f2
lea ecx, [esp + 0x18]
call fcn.00911f0c
mov ecx, dword [esi + 0x73c]
push 2
dec ecx
lea edx, [esp + 0x1c]
push ecx
push 0x25
push 0xa771b0
push edx
mov byte [esp + 0x1174], 0x28
call fcn.00911f42
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x2c]
push eax
push ecx
lea eax, [esp + 0x2c]
push edx
push eax
call fcn.00911f42
mov eax, dword [esi + 0x9c8]
add esp, 0x24
imul eax, dword [esi + 0x73c]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [esi + 0x5ac]
sar ecx, 1
sub eax, ecx
mov ecx, dword [esp + 0x10]
sub eax, 2
mov edx, dword [ecx - 8]
mov dword [esp + 0x1c], edx
push dword [esp + 0x1c]
mov edx, dword [edi]
push ecx
mov ecx, dword [esp + 0x1c]
push ecx
push eax
mov ecx, edi
call dword [edx + 0x64]
lea ecx, [esp + 0x18]
mov byte [esp + 0x1160], bl
call fcn.00911ee2
mov edx, dword [0xa8e750]
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add edx, ebx
sub eax, edx
lea ecx, [esp + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
push eax
push ebx
lea edx, [esp + 0x1c]
push ecx
push edx
push edi
mov ecx, esi
call fcn.004c63e0
jmp 0x4c4226
mov ebx, dword [esp + 0x28]
mov al, byte [0xa8e792]
test al, al
je 0x4c4241
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x14]
push eax
push ecx
push edi
mov ecx, esi
call fcn.004433a0
lea edx, [esp + 0x14]
push ebx
push edx
push edi
mov ecx, esi
call fcn.004c6e50
mov ecx, dword [esi + 0x2194]
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x30]
lea ecx, [esp + 0x858]
mov byte [esp + 0x1160], 0x38
call fcn.009121c4
lea ecx, [esp + 0x818]
mov byte [esp + 0x1160], 0x37
call fcn.0091219a
lea ecx, [esp + 0x7d8]
mov byte [esp + 0x1160], 0x36
call fcn.0091219a
lea ecx, [esp + 0x798]
mov byte [esp + 0x1160], 0x35
call fcn.0091219a
lea ecx, [esp + 0x758]
mov byte [esp + 0x1160], 0x34
call fcn.0091202c
lea ecx, [esp + 0x718]
mov byte [esp + 0x1160], 0x33
call fcn.00912020
lea ecx, [esp + 0x6d8]
mov byte [esp + 0x1160], 0x32
call fcn.00912020
lea ecx, [esp + 0x698]
mov byte [esp + 0x1160], 0x31
call fcn.0091219a
lea ecx, [esp + 0x658]
mov byte [esp + 0x1160], 0x30
call fcn.0091202c
lea edx, [esp + 0x650]
mov dword [esp + 0x650], 0x9ca9a0
mov dword [esp + 0x1c], edx
lea ecx, [esp + 0x650]
mov byte [esp + 0x1160], 0x39
call fcn.00912032
push fcn.00911ee2
push 0x64
lea eax, [esp + 0x334]
mov esi, 0x9ca98c
push 4
push eax
mov dword [esp + 0x660], esi
mov byte [esp + 0x1170], 0x2e
call fcn.009128f2
push fcn.00911ee2
push 0x64
lea ecx, [esp + 0x1a4]
push 4
push ecx
mov byte [esp + 0x1170], 0x2d
call fcn.009128f2
lea ecx, [esp + 0x13c]
mov byte [esp + 0x1160], 0x2c
call fcn.00911ee2
lea ecx, [esp + 0x138]
mov byte [esp + 0x1160], 0x2b
call fcn.00911ee2
lea ecx, [esp + 0x134]
mov byte [esp + 0x1160], 0x2a
call fcn.00911ee2
lea ecx, [esp + 0x130]
mov byte [esp + 0x1160], 0x29
call fcn.00911ee2
lea ecx, [esp + 0xd0]
mov byte [esp + 0x1160], 0x15
call fcn.00911f36
mov dword [esp + 0x9c], 0x9ca970
lea ecx, [esp + 0xac]
mov byte [esp + 0x1160], 0x3a
call fcn.00911ee2
lea ecx, [esp + 0xb4]
mov dword [esp + 0x9c], esi
mov byte [esp + 0x1160], 0x11
call fcn.00911f2a
push fcn.00911ee2
push 0x12d
lea edx, [esp + 0x904]
push 4
push edx
mov byte [esp + 0x1170], 0x3b
call fcn.009128f2
lea ecx, [esp + 0x898]
mov byte [esp + 0x1160], 0x10
call fcn.00911f36
lea ecx, [esp + 0x60]
mov byte [esp + 0x1160], 0xf
call fcn.00911ee2
lea ecx, [esp + 0x58]
mov byte [esp + 0x1160], 0xe
call fcn.00911ee2
lea ecx, [esp + 0x54]
mov byte [esp + 0x1160], 0xd
call fcn.00911ee2
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1160], 0xc
call fcn.00911ee2
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1160], 0xb
call fcn.00911ee2
lea ecx, [esp + 0x50]
mov byte [esp + 0x1160], 0xa
call fcn.00911ee2
lea ecx, [esp + 0x64]
mov byte [esp + 0x1160], 9
call fcn.00911ee2
lea ecx, [esp + 0x6c]
mov byte [esp + 0x1160], 8
call fcn.00911ee2
lea ecx, [esp + 0x74]
mov byte [esp + 0x1160], 7
call fcn.00911ee2
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1160], 6
call fcn.00911ee2
lea ecx, [esp + 0x84]
mov byte [esp + 0x1160], 5
call fcn.00911ee2
lea ecx, [esp + 0x38]
mov byte [esp + 0x1160], 4
call fcn.00911ee2
lea ecx, [esp + 0x30]
mov byte [esp + 0x1160], 3
call fcn.00911ee2
lea ecx, [esp + 0xc]
mov byte [esp + 0x1160], 2
call fcn.00911ee2
lea ecx, [esp + 0x8c]
mov byte [esp + 0x1160], 1
call fcn.00911ee2
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1160], 0
call fcn.00911ee2
lea ecx, [esp + 0x10]
mov dword [esp + 0x1160], 0xffffffff
call fcn.00911ee2
mov ecx, dword [esp + 0x1158]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4