Function at 0x409f48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esp + 0x44], 5
jge 0x40a1e1
test ebx, ebx
je 0x40a1e1
push 0
push 0x4a8d0c
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
je 0x40972a
push 0x104
lea eax, [esp + 0xcc]
push eax
call dword [0x4a1138]
test eax, eax
je 0x40a1c6
lea eax, [esp + 0xc8]
push eax
push 0x4a8d0c
jmp 0x409765
push 0
push 0x4a8d18
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
je 0x409773
push 0x104
lea eax, [esp + 0xcc]
push eax
call dword [0x4a113c]
test eax, eax
je 0x40a1c6
lea eax, [esp + 0xc8]
push eax
push 0x4a8d18
mov ecx, edi
call 0x3dbfd4
mov ebx, eax
jmp 0x40a1c6
push 0
push 0x4a863c
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
je 0x4097a8
lea ecx, [esp + 0x6c]
call fcn.00405a0c
push dword [eax]
mov ecx, edi
push 0x4a863c
call 0x3dbfd4
mov ebx, eax
lea ecx, [esp + 0x6c]
jmp 0x40a1c1
push 0
push 0x4a8d24
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
je 0x409897
push 0x4a8d34
lea ecx, [esp + 0x4c]
call 0x3d5614
lea ecx, [esp + 0x38]
call 0x3dcb04
push 0
push 0x26
lea eax, [esp + 0xd0]
push eax
push 0
call dword [0x4a12d0]
test eax, eax
je 0x4097f8
lea eax, [esp + 0xc8]
push eax
jmp 0x409877
lea eax, [esp + 0x38]
push eax
push ecx
mov ecx, esp
or esi, 1
push 0x4a8d60
mov dword [esp + 0x20], esi
call 0x3d5614
push 0
push 1
push 0
push ecx
lea eax, [esp + 0x60]
mov ecx, esp
push eax
call 0x3d5744
push 0x80000002
lea ecx, [esp + 0x9c]
call fcn.00413f5e
mov ecx, eax
call fcn.00414725
mov esi, dword [esp + 0x38]
test eax, eax
je 0x40984f
cmp dword [esi - 0xc], 0
mov byte [esp + 0x13], 1
jne 0x409854
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
test al, 1
je 0x40986f
and eax, 0xfffffffe
lea ecx, [esp + 0x80]
mov dword [esp + 0x14], eax
call fcn.0041403b
cmp byte [esp + 0x13], 0
je 0x409885
push esi
push 0x4a8d24
mov ecx, edi
call 0x3dbfd4
mov ebx, eax
lea ecx, [esp + 0x38]
call 0x3d5784
lea ecx, [esp + 0x48]
jmp 0x40a1c1
push 0
push 0x4a8d70
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
je 0x409968
push 0x4a8d34
lea ecx, [esp + 0x54]
call 0x3d5614
lea ecx, [esp + 0x24]
call 0x3dcb04
lea eax, [esp + 0x24]
push eax
push ecx
mov ecx, esp
or esi, 2
push 0x4a8d60
mov dword [esp + 0x20], esi
call 0x3d5614
call fcn.0040961c
call dword [eax + 0x6a]
add byte [edx], ch
push ecx
lea eax, [esp + 0x68]
mov ecx, esp
push eax
call 0x3d5744
push 0x80000002
lea ecx, [esp + 0x9c]
call fcn.00413f5e
mov ecx, eax
call fcn.00414725
mov esi, dword [esp + 0x24]
test eax, eax
je 0x409920
cmp dword [esi - 0xc], 0
mov byte [esp + 0x13], 1
jne 0x409925
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
test al, 2
je 0x409940
and eax, 0xfffffffd
lea ecx, [esp + 0x80]
mov dword [esp + 0x14], eax
call fcn.0041403b
cmp byte [esp + 0x13], 0
je 0x409956
push esi
push 0x4a8d70
mov ecx, edi
call 0x3dbfd4
mov ebx, eax
lea ecx, [esp + 0x24]
call 0x3d5784
lea ecx, [esp + 0x50]
jmp 0x40a1c1
push 0
push 0x4a8d84
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
jne 0x40a0b5
push 0
push 0x4a8d94
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
jne 0x40a0b5
push 0
push 0x4a87f8
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
je 0x409a8b
push 0x4a8da8
lea ecx, [esp + 0x6c]
call 0x3d5614
lea ecx, [esp + 0x30]
call 0x3dcb04
push 0
push 0x1a
lea eax, [esp + 0xd0]
push eax
push 0
call dword [0x4a12d0]
test eax, eax
je 0x4099e9
lea eax, [esp + 0xc8]
push eax
jmp 0x409a6b
lea eax, [esp + 0x30]
push eax
push ecx
mov ecx, esp
or esi, 8
push 0x4a8dfc
mov dword [esp + 0x20], esi
call 0x3d5614
push 0
push 1
push 0
push ecx
lea eax, [esp + 0x80]
mov ecx, esp
push eax
call 0x3d5744
push 0x80000001
lea ecx, [esp + 0x9c]
call fcn.00413f5e
mov ecx, eax
call fcn.00414725
mov esi, dword [esp + 0x30]
test eax, eax
je 0x409a43
cmp dword [esi - 0xc], 0
mov byte [esp + 0x13], 1
jne 0x409a48
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
test al, 8
je 0x409a63
and eax, 0xfffffff7
lea ecx, [esp + 0x80]
mov dword [esp + 0x14], eax
call fcn.0041403b
cmp byte [esp + 0x13], 0
je 0x409a79
push esi
push 0x4a87f8
mov ecx, edi
call 0x3dbfd4
mov ebx, eax
lea ecx, [esp + 0x30]
call 0x3d5784
lea ecx, [esp + 0x68]
jmp 0x40a1c1
push 0
push 0x4a8e04
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
je 0x409b7a
push 0x4a8da8
lea ecx, [esp + 0x68]
call 0x3d5614
lea ecx, [esp + 0x40]
call 0x3dcb04
push 0
push 0x23
lea eax, [esp + 0xd0]
push eax
push 0
call dword [0x4a12d0]
test eax, eax
je 0x409adb
lea eax, [esp + 0xc8]
push eax
jmp 0x409b5a
lea eax, [esp + 0x40]
push eax
push ecx
mov ecx, esp
or esi, 0x10
push 0x4a8e14
mov dword [esp + 0x20], esi
call 0x3d5614
push 0
push 1
push 0
push ecx
lea eax, [esp + 0x7c]
mov ecx, esp
push eax
call 0x3d5744
push 0x80000002
lea ecx, [esp + 0x9c]
call fcn.00413f5e
mov ecx, eax
call fcn.00414725
mov esi, dword [esp + 0x40]
test eax, eax
je 0x409b32
cmp dword [esi - 0xc], 0
mov byte [esp + 0x13], 1
jne 0x409b37
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
test al, 0x10
je 0x409b52
and eax, 0xffffffef
lea ecx, [esp + 0x80]
mov dword [esp + 0x14], eax
call fcn.0041403b
cmp byte [esp + 0x13], 0
je 0x409b68
push esi
push 0x4a8e04
mov ecx, edi
call 0x3dbfd4
mov ebx, eax
lea ecx, [esp + 0x40]
call 0x3d5784
lea ecx, [esp + 0x64]
jmp 0x40a1c1
push 0
push 0x4a8e24
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
je 0x409c71
push 0x4a8da8
lea ecx, [esp + 0x60]
call 0x3d5614
lea ecx, [esp + 0x28]
call 0x3dcb04
push 0
push 5
lea eax, [esp + 0xd0]
push eax
push 0
call dword [0x4a12d0]
test eax, eax
je 0x409bd2
lea eax, [esp + 0xc8]
push eax
push 0x4a8e24
jmp 0x409c56
lea eax, [esp + 0x28]
push eax
push ecx
mov ecx, esp
or esi, 0x20
push 0x4a8e34
mov dword [esp + 0x20], esi
call 0x3d5614
push 0
push 1
push 0
push ecx
lea eax, [esp + 0x74]
mov ecx, esp
push eax
call 0x3d5744
push 0x80000001
lea ecx, [esp + 0x9c]
call fcn.00413f5e
mov ecx, eax
call fcn.00414725
mov esi, dword [esp + 0x28]
test eax, eax
je 0x409c29
cmp dword [esi - 0xc], 0
mov byte [esp + 0x13], 1
jne 0x409c2e
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
test al, 0x20
je 0x409c49
and eax, 0xffffffdf
lea ecx, [esp + 0x80]
mov dword [esp + 0x14], eax
call fcn.0041403b
cmp byte [esp + 0x13], 0
je 0x409c5f
push esi
push 0x4a87f8
mov ecx, edi
call 0x3dbfd4
mov ebx, eax
lea ecx, [esp + 0x28]
call 0x3d5784
lea ecx, [esp + 0x5c]
jmp 0x40a1c1
push 0
push 0x4a8e40
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
jne 0x409fa4
push 0
push 0x4a8e4c
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
jne 0x409fa4
xor ebx, ebx
push ebx
mov esi, 0x4a8e64
push esi
mov ecx, edi
call 0x3dc1d4
cmp eax, 0xffffffff
je 0x409d8b
push 0x4a837c
lea ecx, [esp + 0x1c]
call 0x3d5614
cmp dword [esp + 0x4c], ebx
je 0x409d3e
call fcn.00408f5b
cmp eax, 4
jl 0x409d3e
push ecx
mov ecx, esp
push esi
call 0x3d5614
lea ecx, [esp + 0x80]
call fcn.004152a0
mov edx, dword [eax]
mov ebx, dword [esp + 0x1c]
pop ecx
lea ecx, [edx - 0x10]
add ebx, 0xfffffff0
cmp ecx, ebx
je 0x409d31
cmp dword [ebx + 0xc], 0
jl 0x409d24
mov eax, dword [ecx]
cmp eax, dword [ebx]
jne 0x409d24
call 0x3d56e4
mov ecx, ebx
mov esi, eax
call 0x3d5764
lea eax, [esi + 0x10]
mov dword [esp + 0x18], eax
mov esi, 0x4a8e64
jmp 0x409d31
push dword [edx - 0xc]
lea ecx, [esp + 0x1c]
push edx
call 0x3d5534
lea ecx, [esp + 0x7c]
call 0x3d5784
xor ebx, ebx
jmp 0x409d6e
push 0x104
lea eax, [esp + 0xcc]
push eax
push esi
call dword [0x4a1140]
lea ecx, [esp + 0x18]
test eax, eax
jne 0x409d61
push 0x4a837c
jmp 0x409d69
lea eax, [esp + 0xc8]
push eax
call 0x3d55d4
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebx
je 0x409d82
push eax
push esi
mov ecx, edi
call 0x3dbfd4
mov ebx, eax
lea ecx, [esp + 0x18]
jmp 0x40a1c1
push ebx
mov esi, 0x4a8e74
push esi
mov ecx, edi
call 0x3dc1d4
push ebx
mov ecx, edi
cmp eax, 0xffffffff
je 0x409f62
push esi
call 0x3dc1d4
lea esi, [eax + 5]
push esi
push 0x4a8e7c
mov ecx, edi
mov dword [esp + 0x5c], eax
call 0x3dc1d4
mov ebx, eax
test ebx, ebx
jns 0x409dff
push ecx
mov ecx, esp
push 0x4a8e80
call 0x3d5614
push 0x23e
push ecx
mov ecx, esp
push 0x4a8ac4
call 0x3d5614
push ecx
mov ecx, esp
push 0x4a8ea0
call 0x3d5614
push 1
call fcn.00408ad6
xor ebx, ebx
jmp 0x40a1c6
lea ecx, [esp + 0x20]
call 0x3dcb04
lea ecx, [esp + 0x1c]
call 0x3dcb04
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
sub ecx, esi
push ecx
mov eax, esp
push ecx
push esi
push eax
mov ecx, edi
call fcn.00405800
lea edx, [esp + 0x28]
lea ecx, [esp + 0x80]
call fcn.00416444
pop ecx
pop ecx
lea ecx, [esp + 0x2c]
call 0x3dcb04
push 0
push 1
push 0
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
push eax
call 0x3d5744
push dword [esp + 0x88]
lea ecx, [esp + 0x94]
call fcn.00413f5e
cmp dword [esp + 0xb0], 0
je 0x409ebf
lea eax, [esp + 0x2c]
push eax
push ecx
lea eax, [esp + 0x24]
mov ecx, esp
push eax
call 0x3d5744
lea ecx, [esp + 0x88]
call fcn.00414725
test eax, eax
je 0x409ebf
mov esi, dword [esp + 0x2c]
cmp dword [esi - 0xc], 0
je 0x409ebf
mov eax, dword [esp + 0x54]
sub ebx, eax
inc ebx
push ebx
push eax
mov ecx, edi
call fcn.00407ea6
push esi
push dword [esp + 0x58]
mov ecx, edi
call fcn.00407f28
xor ebx, ebx
inc ebx
jmp 0x409f3b
push ecx
mov ecx, esp
push 0x4a8e80
call 0x3d5614
push 0x252
add byte [ecx - 0x75], dl
int3
push 0x4a8ac4
call 0x3d5614
push ecx
mov esi, esp
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x34]
push 0x4a8eb4
push eax
mov edx, 0x4a8eb8
lea ecx, [esp + 0x90]
call 0x3dc404
pop ecx
mov edx, eax
lea ecx, [esp + 0x88]
call 0x3dc334
pop ecx
mov edx, eax
mov ecx, esi
call 0x3dc274
pop ecx
call dword [0x4a1084]
push eax
call fcn.00408ad6
lea ecx, [esp + 0x70]
call 0x3d5784
lea ecx, [esp + 0x74]
call 0x3d5784
xor ebx, ebx
lea ecx, [esp + 0x80]
call fcn.0041403b
lea ecx, [esp + 0x2c]
dec esp
and al, 0x2c
call 0x3d5784
lea ecx, [esp + 0x1c]
call 0x3d5784
lea ecx, [esp + 0x20]
jmp 0x40a1c1
push 0x4a8ed4
call 0x3dc1d4
test eax, eax
jns 0x40a1c6
push ebx
push 0x4a8ee8
mov ecx, edi
call 0x3dc1d4
test eax, eax
jns 0x40a1c6
push ecx
mov ecx, esp
push edi
mov edx, 0x4a8ef8
call 0x3dc404
pop ecx
push 1
call fcn.00404b70
jmp 0x40a1c6
push 0x4a8da8
lea ecx, [esp + 0x5c]
call 0x3d5614
lea ecx, [esp + 0x34]
call 0x3dcb04
push 0
push 0x10
lea eax, [esp + 0xd0]
push eax
push 0
call dword [0x4a12d0]
test eax, eax
je 0x409ffc
lea eax, [esp + 0xc8]
push eax
push 0x4a8e4c
mov ecx, edi
call 0x3dbfd4
test eax, eax
jne 0x40a0a0
lea eax, [esp + 0xc8]
push eax
jmp 0x40a08c
lea eax, [esp + 0x34]
push eax
push ecx
mov ecx, esp
or esi, 0x40
push 0x4a8e5c
mov dword [esp + 0x20], esi
call 0x3d5614
push 0
push 1
push 0
push ecx
lea eax, [esp + 0x70]
mov ecx, esp
push eax
call 0x3d5744
push 0x80000001
lea ecx, [esp + 0x9c]
call fcn.00413f5e
mov ecx, eax
call fcn.00414725
mov esi, dword [esp + 0x34]
test eax, eax
je 0x40a053
invalid
cmp dword [esi - 0xc], 0
mov byte [esp + 0x13], 1
jne 0x40a058
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
test al, 0x40
je 0x40a073
and eax, 0xffffffbf
lea ecx, [esp + 0x80]
mov dword [esp + 0x14], eax
call fcn.0041403b
cmp byte [esp + 0x13], 0
je 0x40a0a3
push esi
push 0x4a8e4c
mov ecx, edi
call 0x3dbfd4
test eax, eax
jne 0x40a0a0
push esi
push 0x4a8e40
mov ecx, edi
call 0x3dbfd4
test eax, eax
jne 0x40a0a0
xor ebx, ebx
jmp 0x40a0a3
xor ebx, ebx
inc ebx
lea ecx, [esp + 0x34]
call 0x3d5784
lea ecx, [esp + 0x58]
jmp 0x40a1c1
push 0x4a8da8
lea ecx, [esp + 0x64]
call 0x3d5614
lea ecx, [esp + 0x3c]
call 0x3dcb04
push 0
push 0x1c
lea eax, [esp + 0xd0]
push eax
push 0
call dword [0x4a12d0]
test eax, eax
je 0x40a10d
lea eax, [esp + 0xc8]
push eax
push 0x4a8d84
mov ecx, edi
call 0x3dbfd4
test eax, eax
jne 0x40a1b1
lea eax, [esp + 0xc8]
push eax
jmp 0x40a19d
lea eax, [esp + 0x3c]
push eax
push ecx
mov ecx, esp
or esi, 4
push 0x4a8dec
mov dword [esp + 0x20], esi
call 0x3d5614
push 0
push 1
push 0
push ecx
lea eax, [esp + 0x78]
mov ecx, esp
push eax
call 0x3d5744
push 0x80000001
lea ecx, [esp + 0x9c]
call fcn.00413f5e
mov ecx, eax
call fcn.00414725
mov esi, dword [esp + 0x3c]
test eax, eax
je 0x40a164
cmp dword [esi - 0xc], 0
mov byte [esp + 0x13], 1
jne 0x40a169
mov byte [esp + 0x13], 0
mov eax, dword [esp + 0x14]
test al, 4
je 0x40a184
and eax, 0xfffffffb
lea ecx, [esp + 0x80]
mov dword [esp + 0x14], eax
call fcn.0041403b
cmp byte [esp + 0x13], 0
je 0x40a1b4
push esi
push 0x4a8d84
mov ecx, edi
call 0x3dbfd4
test eax, eax
jne 0x40a1b1
push esi
push 0x4a8d94
mov ecx, edi
call 0x3dbfd4
test eax, eax
jne 0x40a1b1
xor ebx, ebx
jmp 0x40a1b4
xor ebx, ebx
inc ebx
lea ecx, [esp + 0x3c]
call 0x3d5784
lea ecx, [esp + 0x60]
call 0x3d5784
inc dword [esp + 0x44]
push ecx
push 0x25
mov ecx, edi
call fcn.00407fb4
mov esi, dword [esp + 0x14]
cmp eax, 0xffffffff
jg 0x4096da
cmp dword [esp + 0x4c], 0
je 0x40a1ed
call fcn.00408dfc
mov ecx, dword [esp + 0x1d4]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call 0x3ea8d5
mov esp, ebp
pop ebp
ret