Function at 0x404730
Capabilities:
Enumerate pe sections
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x9c
mov eax, dword [ebp + 0x24]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x20], 0x3fff
cmp eax, 0xffc3d44f
je 0x404765
cmp eax, 0xffc3d44e
je 0x404765
mov byte [esp + 0xf], bl
cmp eax, 0xffc3d44d
jne 0x40476a
mov byte [esp + 0xf], 1
mov ecx, dword [0x4a3544]
cmp ecx, ebx
jne 0x404781
lea edi, [esp + 0x38]
mov dword [esp + 0x10], edi
jmp 0x404820
mov eax, dword [0x4a3548]
mov edi, eax
imul edi, edi, 0x70
inc eax
add edi, ecx
mov dword [esp + 0x10], edi
mov dword [0x4a3548], eax
cmp eax, dword [0x49f398]
jl 0x4047a5
mov dword [0x4a3548], ebx
mov al, byte [ebp + 0x18]
mov cl, byte [ebp + 0x20]
mov byte [edi], al
mov byte [edi + 5], cl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [0x4a548c]
mov dword [0x4a354c], eax
mov dword [esp + 0x30], edx
fild dword [esp + 0x30]
jns 0x4047d3
fadd dword [0x49a2b8]
fdiv qword [0x49a2b0]
mov dword [0x4a548c], eax
fstp dword [edi + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x404813
cmp esi, dword [0x4a3550]
je 0x40480e
mov ecx, dword [0x4a2c30]
push esi
lea eax, [edi + 0xc]
push eax
push 0x418
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40481a
mov byte [edi + 0xc], bl
jmp 0x40481a
mov dword [edi + 0xc], 0x412f4e
mov dword [0x4a3550], esi
mov al, byte [ebp + 0x18]
cmp al, 0xe7
jne 0x40483f
mov edx, dword [ebp + 0x14]
mov ax, word [edx + 4]
mov word [edi + 2], ax
mov byte [edi + 4], 0x55
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov cx, word [ebp + 0x1c]
add al, 0x64
mov word [edi + 2], cx
cmp al, 3
ja 0x404850
mov dword [ebp + 0x1c], ebx
mov edi, dword [ebp + 8]
cmp edi, dword [0x4a2d64]
jne 0x404881
mov bl, byte [ebp + 0x28]
and bl, 1
jne 0x4049af
cmp byte [ebp + 0x20], bl
movzx eax, byte [ebp + 0x18]
setne dl
dec dl
and dl, 0x80
mov byte [eax + 0x4a2c50], dl
jmp 0x4049af
mov ebx, dword [ebp + 0x28]
shr ebx, 4
and bl, 1
test dword [ebp + 0x1c], 0x100
jne case.0x4048c1.13
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je case.0x4048c1.13
movzx eax, byte [ebp + 0x18]
add eax, 0xfffffff4
cmp eax, 0x62
ja case.0x4048c1.13
movzx ecx, byte [eax + 0x4062e4]
jmp dword [ecx*4 + 0x4062b4]
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x4a1b24], dl
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x4a1b25], al
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete cl
mov byte [0x4a1b26], cl
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x4a1b27], dl
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x4a1b28], al
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete cl
mov byte [0x4a1b29], cl
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x4a1b2a], dl
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x4a1b2b], al
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete cl
mov byte [0x4a1b2c], cl
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x4a1b2d], dl
jmp case.0x4048c1.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x4a1b2e], al
movzx esi, byte [ebp + 0x18]
mov edx, dword [0x4a3568]
lea ecx, [esi + esi*8]
shl ecx, 5
cmp byte [ecx + edx + 4], 0
jne 0x4049af
test byte [ebp + 0x28], 0x10
jne 0x4049af
mov eax, dword [ebp + 0x20]
push eax
mov al, byte [ebp + 0x18]
call fcn.00407640
add esp, 4
test al, al
je 0x4049af
cmp byte [ebp + 0x20], 0
setne cl
dec cl
and cl, 0x80
mov byte [esi + 0x4a2c50], cl
cmp byte [esp + 0xf], 0
je 0x4049ba
mov al, 0x69
jmp 0x4049c6
neg bl
sbb bl, bl
and bl, 0x41
add bl, 0x20
mov al, bl
cmp byte [0x4a2d50], 0
mov esi, dword [esp + 0x10]
mov byte [esi + 4], al
je 0x404a12
mov al, byte [ebp + 0x18]
cmp al, 0x5b
je 0x4049e1
cmp al, 0x5c
jne 0x404a12
cmp byte [ebp + 0x20], 0
jne 0x404a12
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
push 0
push SysReAllocString
push 0x3fff
push esi
push edx
push eax
xor bl, bl
mov eax, edi
call fcn.004063e0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x4a1b48], 0
je 0x404abb
cmp byte [ebp + 0x18], 0x1b
jne 0x404abb
cmp byte [ebp + 0x20], 0
jne 0x404abb
push 0
push str.32771
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x404abb
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebx, eax
jne 0x404abb
push 0xffc3d44d
push 0
push 0
push 0
push 0x1b
push 0
call fcn.0040e7b0
mov cl, byte [0x4a2c2d]
push 0xffc3d44d
shr cl, 3
push 0
and cl, 1
or cl, 0xa4
push 0
movzx edx, cl
push 0
push edx
push 1
call fcn.0040e7b0
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x14]
push 0
push SysReAllocString
push 0x3fff
push esi
push eax
push 0x1b
xor bl, bl
mov eax, edi
call fcn.004063e0
add esp, 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, word [ebp + 0x1c]
mov edx, dword [0x4a3568]
lea ecx, [eax + eax*8]
mov eax, dword [0x4a356c]
shl ecx, 5
add eax, ecx
mov cl, byte [eax + 0x12]
mov byte [esp + 0x27], cl
cmp edi, dword [0x4a2d60]
jne 0x404aec
test cl, cl
je 0x404aec
mov bl, byte [ebp + 0x18]
mov esi, eax
jmp 0x404afa
mov bl, byte [ebp + 0x18]
movzx eax, bl
lea esi, [eax + eax*8]
shl esi, 5
add esi, edx
cmp byte [esp + 0xf], 0
mov dword [esp + 0x18], esi
je 0x404b43
cmp dword [ebp + 0x24], 0xffc3d44e
jne 0x404b2e
cmp byte [ebp + 0x20], 0
je 0x404b2e
cmp dword [0x4a1b44], esi
jne 0x404b2e
mov byte [esi + 0xc], 0
mov byte [esi + 0xf], 0
mov dword [0x4a1b44], 0
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x20]
push 0
push 0x3fff
push ecx
push edx
jmp 0x406294
mov ecx, dword [ebp + 0x20]
test cl, cl
jne 0x404b56
mov eax, 0x3fff
mov byte [esi + 0x10], cl
mov word [esi + 6], ax
cmp edi, dword [0x4a2d60]
jne 0x404c11
test cl, cl
je 0x404c77
cmp byte [0x4a1b4c], 0
je 0x404b78
cmp bl, 0x5b
je 0x404baa
cmp byte [0x4a1b4b], 0
je 0x404b86
cmp bl, 0x5c
je 0x404baa
cmp byte [0x4a1b4a], 0
je 0x404b94
cmp bl, 0xa4
je 0x404baa
cmp byte [0x4a1b49], 0
je 0x404c77
cmp bl, 0xa5
jne 0x404c77
movzx eax, bl
add eax, 0xffffffa5
cmp eax, 0x4a
ja case.0x404bbc.93
movzx eax, byte [eax + 0x40635c]
jmp dword [eax*4 + 0x406348]
mov byte [0x4a1b4c], 0
jmp case.0x404bbc.93
mov byte [0x4a1b4b], 0
jmp case.0x404bbc.93
mov byte [0x4a1b4a], 0
jmp case.0x404bbc.93
mov byte [0x4a1b49], 0
test byte [0x4a2c2d], 3
jne 0x404c77
movzx ecx, byte [0x49f355]
push 0xffc3d44d
push 0
push 0
push 0
push ecx
push 2
call fcn.0040e7b0
add esp, 0x18
jmp 0x404c6e
test bl, bl
jne 0x404c31
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x10]
push 0
push 0x3fff
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push ecx
xor cl, cl
jmp 0x40629e
cmp bl, 1
je 0x404c3b
cmp bl, 2
jne 0x404c77
cmp dword [0x4a2dbc], 0
jne 0x40627b
push 0
push str.32768
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x404c6e
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a4c44]
je 0x406278
mov edx, dword [0x4a3568]
mov ecx, dword [ebp + 0x20]
mov eax, dword [0x4a1b44]
test eax, eax
je 0x404cb0
cmp eax, esi
je 0x404cb0
test cl, cl
jne 0x404cb0
cmp edi, dword [0x4a2d60]
jne 0x404c9a
xor eax, eax
cmp byte [esi + 4], al
sete al
jmp 0x404ca3
mov eax, dword [0x4a1b44]
movzx eax, byte [eax + 4]
test eax, eax
je 0x404cb0
mov eax, dword [0x4a1b44]
mov byte [eax + 0x11], 1
cmp byte [esi + 8], 0
jne 0x404cc0
cmp byte [esi + 9], 0
je 0x406287
mov cl, byte [ebp + 0x20]
mov ebx, 0x3fff
mov byte [esp + 0x2b], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x34], 0
test cl, cl
je 0x404d13
mov al, byte [esi + 0xf]
mov dl, byte [esi + 0xc]
mov byte [esp + 0x1e], al
movzx eax, word [esi + 6]
mov byte [esp + 0x1d], dl
mov edx, ebx
mov byte [esi + 0xf], 0
cmp ax, dx
je 0x404d0b
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x2b], 1
mov word [esi + 6], ax
mov edx, dword [0x4a3568]
test cl, cl
sete al
mov byte [esi + 0xc], al
mov byte [esp + 0xd], 0
cmp edi, dword [0x4a2d60]
jne 0x404d9b
cmp byte [esi + 4], 0
je 0x404dc0
cmp byte [edx + 0xb64c], 0
jne 0x404d46
cmp byte [edx + 0xb76c], 0
jne 0x404d46
xor eax, eax
jmp 0x404d4b
mov eax, 1
cmp byte [edx + 0xb88c], 0
mov byte [edx + 0x132c], al
jne 0x404d67
cmp byte [edx + 0xb9ac], 0
jne 0x404d67
xor eax, eax
jmp 0x404d6c
mov eax, 1
cmp byte [edx + 0xb40c], 0
mov byte [edx + 0x144c], al
jne 0x404d8e
cmp byte [edx + 0xb52c], 0
jne 0x404d8e
xor eax, eax
mov byte [edx + 0x120c], al
jmp 0x404dc0
mov eax, 1
mov byte [edx + 0x120c], al
jmp 0x404dc0
cmp dword [0x4a2d60], 0
jne 0x404dc0
push 1
call fcn.00410da0
mov cl, byte [ebp + 0x20]
add esp, 4
mov byte [0x4a2c2e], al
mov byte [0x4a2c2d], al
mov byte [esp + 0xd], 1
mov eax, dword [esi]
test eax, eax
je 0x404dd0
cmp dword [eax], 7
mov byte [esp + 0xf], 1
je 0x404dd5
mov byte [esp + 0xf], 0
mov al, byte [esi + 8]
test al, al
je 0x404f73
test cl, cl
jne 0x404f73
mov ecx, dword [0x4a1b44]
test ecx, ecx
je 0x404e00
cmp byte [esi + 9], 0
je 0x404e00
cmp esi, ecx
jne 0x404f73
cmp al, 1
jne 0x404e2c
cmp byte [esp + 0x27], 0
movzx eax, word [ebp + 0x1c]
jne 0x404e13
movzx eax, byte [ebp + 0x18]
mov ecx, dword [esp + 0x27]
push ecx
push eax
call fcn.00409880
add esp, 8
test al, al
je 0x404e2c
mov byte [esp + 0xe], 1
jmp 0x404e43
mov byte [esp + 0xe], 0
cmp esi, dword [0x4a1b44]
je 0x404e43
mov dword [0x4a1b44], esi
mov byte [esi + 0x11], 0
cmp byte [esi + 9], 0
je 0x404ef1
cmp byte [esp + 0xd], 0
jne 0x404e63
push 1
mov byte [esp + 0x11], 1
call fcn.00410da0
add esp, 4
mov al, byte [esi + 4]
mov cl, byte [0x4a2c2e]
test al, al
je 0x404e74
not al
and cl, al
test cl, cl
jne 0x404e7e
cmp byte [esp + 0xe], cl
je 0x404ef1
cmp edi, dword [0x4a2d60]
jne 0x404ea4
cmp byte [esp + 0x27], 0
je 0x404ea4
movzx eax, word [ebp + 0x1c]
movzx edx, cl
shl edx, 9
add edx, eax
mov eax, dword [0x4a3560]
movzx ebx, word [eax + edx*2]
jmp 0x404eb9
movzx edx, byte [ebp + 0x18]
mov eax, dword [0x4a355c]
movzx ecx, cl
shl ecx, 8
add ecx, edx
movzx ebx, word [eax + ecx*2]
mov dword [esp + 0x14], ebx
test ebx, 0x4000
je 0x404ecb
mov word [esi + 6], bx
jmp 0x404efb
mov edx, dword [0x4a0580]
mov ecx, ebx
and ecx, 0x3fff
mov eax, ecx
cmp ax, word [edx]
jae 0x404ef1
mov ecx, dword [0x4a3564]
movzx eax, ax
mov dx, word [ecx + eax*2]
mov word [esi + 6], dx
mov eax, 0x3fff
cmp bx, ax
jne 0x404f73
mov al, byte [esp + 0xe]
test al, al
je 0x404f0f
mov ecx, dword [esp + 0x10]
or byte [esi + 0xb], 8
mov byte [ecx + 4], 0x23
cmp byte [esi + 4], 0
jne 0x404f55
test byte [esi + 0xb], 1
jne 0x404f55
cmp byte [esp + 0xf], 0
jne 0x404f55
test al, al
jne 0x404f55
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edx
push eax
push ecx
mov ecx, dword [ebp + 0x14]
xor bl, bl
mov eax, edi
call fcn.004063e0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push 0
push 0x3fff
push edx
push 0
push eax
push ecx
mov cl, byte [ebp + 0x18]
jmp 0x40629e
cmp byte [esi + 9], 0
mov byte [esp + 0x1f], 0
je 0x405021
cmp byte [ebp + 0x20], 0
je 0x405021
cmp dword [0x4a1b44], esi
jne 0x404fa9
cmp byte [esp + 0x1e], 0
je 0x405021
mov dword [0x4a1b44], 0
cmp byte [esi + 0xa], 0
jne 0x40501c
mov al, byte [esi + 0xb]
test al, 8
je 0x404fbf
xor cl, cl
and al, 0xf7
mov byte [esi + 0xb], al
jmp 0x404fc1
mov cl, 1
cmp byte [esp + 0x1e], 0
je 0x404ffc
test cl, cl
je 0x404ffc
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov bl, byte [ebp + 0x20]
push 0
push SysReAllocString
push 0x3fff
push edx
push eax
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, edi
call fcn.004063e0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push 0
push 0x3fff
push edx
mov edx, dword [ebp + 0xc]
push eax
push ecx
mov cl, byte [ebp + 0x18]
push edx
jmp 0x40629e
mov byte [esp + 0x1f], 1
cmp byte [esi + 8], 0
je 0x405208
cmp byte [ebp + 0x20], 0
je 0x405208
cmp dword [0x4a1b44], esi
jne 0x405047
mov dword [0x4a1b44], 0
cmp byte [esi + 0xd], 0
je 0x405068
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 1
mov byte [esi + 0xd], 0
call fcn.0040e7b0
add esp, 0x18
cmp byte [esi + 0xe], 0
je 0x405089
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
mov byte [esi + 0xe], 0
call fcn.0040e7b0
add esp, 0x18
mov eax, 0x3fff
cmp bx, ax
jne 0x4050bf
mov al, byte [esi + 0xb]
test al, 8
je 0x4050bf
and al, 0xf7
mov byte [esi + 0xb], al
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x10]
push 0
push 0x3fff
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
mov cl, byte [ebp + 0x18]
jmp 0x40629e
mov cl, byte [esp + 0xf]
mov al, byte [esi + 0x11]
test cl, cl
je 0x405146
cmp al, 2
jne 0x405122
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
push 0xffc3d44e
push 0
push 0
push ebx
push esi
push 1
call fcn.0040e7b0
push 0xffc3d44d
push 0
push 0
push ebx
push esi
push 2
call fcn.0040e7b0
mov edx, dword [esp + 0x40]
mov ecx, dword [ebp + 0x14]
push 0
push SysReAllocString
push 0x3fff
push edx
push ebx
mov bl, byte [ebp + 0x20]
push esi
mov eax, edi
call fcn.004063e0
add esp, 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp al, 1
jne 0x4051a5
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x10]
push 0
push 0x3fff
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov cl, byte [ebp + 0x18]
push edx
push eax
jmp 0x40629e
test al, al
je 0x4051a5
mov edx, 0x3fff
cmp bx, dx
jne 0x4051a5
cmp byte [esi + 4], 0
je 0x40517e
cmp al, 2
jne 0x40509f
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x20]
push 1
push edx
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov cl, byte [ebp + 0x18]
push edx
push eax
jmp 0x40629e
test byte [esi + 0xb], 1
push 0
je 0x4051c9
mov edx, dword [esp + 0x14]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push 0x3fff
push edx
mov edx, dword [ebp + 0xc]
push eax
push ecx
mov cl, byte [ebp + 0x18]
push edx
push edi
jmp 0x40629f
cmp byte [esi + 9], 0
jne 0x4051f7
cmp byte [esi + 4], 0
jne 0x405126
test byte [esi + 0xb], 1
jne 0x405126
test cl, cl
jne 0x405126
push 0
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov bl, byte [ebp + 0x20]
push SysReAllocString
push 0x3fff
push eax
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov eax, edi
call fcn.004063e0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esp + 0x1d], 0
jne 0x405208
cmp byte [esi + 0xa], 0
je 0x40509f
cmp byte [esp + 0xd], 0
jne 0x405223
mov edx, 0x3fff
cmp bx, dx
jne 0x405223
push 1
call fcn.00410da0
add esp, 4
cmp dword [0x4a1b44], 0
mov byte [esp + 0xe], 0
je 0x405907
cmp byte [ebp + 0x20], 0
je 0x405249
mov eax, dword [esp + 0x18]
cmp byte [eax + 0xa], 0
je 0x405907
mov ecx, 0x3fff
cmp bx, cx
jne 0x405ba7
mov edx, dword [esp + 0x18]
xor edi, edi
cmp byte [edx + 0x13], 0
jbe 0x405369
mov esi, edx
mov edx, dword [0x4a3568]
add esi, 0x16
mov cl, byte [esi]
movzx eax, cl
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + edx + 0xc], 0
je 0x4052bf
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x4052a9
cmp byte [ebp + 0x20], 0
jne 0x4052d1
mov ecx, dword [esp + 0x18]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp bx, ax
jne 0x4052f3
jmp 0x4052bf
cmp byte [ebp + 0x20], 0
jne 0x4052bb
mov ebx, eax
mov dword [esp + 0x14], ebx
mov byte [esp + 0xd], cl
jmp 0x4052bf
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, byte [ecx + 0x13]
inc edi
add esi, 4
cmp edi, eax
jl 0x405272
jmp 0x4052df
movzx ebx, word [esi + 2]
mov cl, byte [esi]
mov dword [esp + 0x14], ebx
mov byte [esp + 0xd], cl
mov edx, 0x3fff
cmp bx, dx
je 0x405369
mov edx, dword [0x4a3568]
movzx ecx, byte [esp + 0xd]
mov eax, ecx
sub eax, 0x10
je 0x405350
dec eax
je 0x405334
dec eax
je 0x405318
lea ecx, [ecx + ecx*8]
shl ecx, 5
add ecx, edx
mov dword [0x4a1b44], ecx
jmp 0x4053e0
xor eax, eax
cmp byte [edx + 0xb9ac], al
setne al
lea eax, [eax + eax*8 + 0x5c4]
shl eax, 5
add eax, edx
jmp 0x4053db
xor eax, eax
cmp byte [edx + 0xb76c], al
setne al
lea eax, [eax + eax*8 + 0x5b2]
shl eax, 5
add eax, edx
jmp 0x4053db
xor eax, eax
cmp byte [edx + 0xb52c], al
setne al
lea eax, [eax + eax*8 + 0x5a0]
shl eax, 5
add eax, edx
jmp 0x4053db
mov eax, dword [esp + 0x18]
xor edi, edi
cmp byte [eax + 0x14], 0
jbe 0x4053ee
mov edx, dword [esp + 0x2c]
mov esi, eax
add esi, 0xde
movzx ecx, word [esi]
mov ebx, dword [0x4a356c]
mov eax, ecx
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x405417
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x405407
cmp byte [ebp + 0x20], 0
jne 0x405431
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp bx, ax
je 0x40541b
mov dword [esp + 0x2c], edx
movzx eax, dx
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4a356c]
mov dword [0x4a1b44], eax
mov edx, 0x3fff
cmp bx, dx
jne case.default.0x405400
movzx eax, byte [ebp + 0x18]
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x405400
jmp dword [eax*4 + 0x4063a8]
cmp byte [ebp + 0x20], 0
jne 0x405417
mov ebx, eax
mov dword [esp + 0x14], ebx
mov edx, ecx
jmp 0x40541b
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, byte [ecx + 0x14]
inc edi
add esi, 4
cmp edi, eax
jl 0x405381
jmp 0x40543c
movzx ebx, word [esi + 2]
movzx edx, word [esi]
mov dword [esp + 0x14], ebx
mov ecx, 0x3fff
mov dword [esp + 0x2c], edx
cmp bx, cx
je 0x4053ee
jmp 0x4053cc
mov al, 0x11
jmp 0x405456
mov al, 0x12
jmp 0x405456
mov al, 0x10
mov ecx, dword [0x4a3568]
movzx eax, al
lea esi, [eax + eax*8]
shl esi, 5
movzx edx, byte [esi + ecx + 0x13]
add esi, ecx
xor edi, edi
mov dword [esp + 0x30], esi
test edx, edx
jle 0x4054f3
add esi, 0x16
lea ecx, [ecx]
mov cl, byte [esi]
mov ebx, dword [0x4a3568]
movzx eax, cl
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x4054d3
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x4054c1
cmp byte [ebp + 0x20], 0
jne 0x4054e1
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp bx, ax
jne 0x405501
jmp 0x4054d7
cmp byte [ebp + 0x20], 0
jne 0x4054d3
mov ebx, eax
mov dword [esp + 0x14], ebx
mov byte [esp + 0xd], cl
jmp 0x4054d7
mov ebx, dword [esp + 0x14]
inc edi
add esi, 4
cmp edi, edx
jl 0x405480
jmp 0x4054ef
movzx ebx, word [esi + 2]
mov cl, byte [esi]
mov dword [esp + 0x14], ebx
mov byte [esp + 0xd], cl
mov esi, dword [esp + 0x30]
mov edx, 0x3fff
cmp bx, dx
je 0x405590
movzx ecx, byte [esp + 0xd]
mov eax, ecx
sub eax, 0x10
je 0x40556e
dec eax
je 0x40554c
dec eax
je 0x40552a
lea ecx, [ecx + ecx*8]
shl ecx, 5
add ecx, dword [0x4a3568]
mov dword [0x4a1b44], ecx
jmp case.default.0x405400
mov ecx, dword [0x4a3568]
xor eax, eax
cmp byte [ecx + 0xb9ac], al
setne al
lea eax, [eax + eax*8 + 0x5c4]
shl eax, 5
add eax, ecx
jmp 0x40562f
mov ecx, dword [0x4a3568]
xor eax, eax
cmp byte [ecx + 0xb76c], al
setne al
lea eax, [eax + eax*8 + 0x5b2]
shl eax, 5
add eax, ecx
jmp 0x40562f
mov ecx, dword [0x4a3568]
xor eax, eax
cmp byte [ecx + 0xb52c], al
setne al
lea eax, [eax + eax*8 + 0x5a0]
shl eax, 5
add eax, ecx
jmp 0x40562f
movzx edx, byte [esi + 0x14]
xor edi, edi
test edx, edx
jle case.default.0x405400
add esi, 0xde
movzx ecx, word [esi]
mov ebx, dword [0x4a356c]
mov eax, ecx
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x4055f7
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x4055e5
cmp byte [ebp + 0x20], 0
jne 0x405605
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp bx, ax
jne 0x40561e
jmp 0x4055fb
cmp byte [ebp + 0x20], 0
jne 0x4055f7
mov ebx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], ecx
jmp 0x4055fb
mov ebx, dword [esp + 0x14]
inc edi
add esi, 4
cmp edi, edx
jl 0x4055a4
jmp 0x405614
movzx ebx, word [esi + 2]
movzx edx, word [esi]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], edx
mov eax, 0x3fff
cmp bx, ax
je case.default.0x405400
movzx eax, word [esp + 0x2c]
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4a356c]
mov dword [0x4a1b44], eax
mov esi, ebx
mov edx, 0x3fff
and esi, 0x3fff
cmp bx, dx
je 0x4056f2
mov eax, dword [0x4a0580]
cmp si, word [eax]
jae 0x4056e8
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov edi, dword [ebp + 0x20]
add esi, 4
push esi
lea ecx, [esp + 0x12]
push ecx
add edx, 0xb
push edx
lea eax, [esp + 0x20]
push edi
push eax
call fcn.00409b70
add esp, 0x14
test eax, eax
je 0x4056bb
mov ecx, dword [ebp + 0x24]
lea edx, [ecx + 0x3c2c17]
cmp edx, 0x66
ja 0x4056aa
movzx edx, byte [eax + 0x21]
mov ebx, 0xffc3d44d
sub ebx, ecx
cmp ebx, edx
jg 0x4056aa
test esi, esi
je 0x4056a6
mov byte [esi], 0x69
xor cl, cl
jmp 0x4056ac
mov cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [esp + 0x34], ecx
jne 0x4056dc
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push 0x3fff
push eax
mov eax, dword [ebp + 8]
push edi
push ecx
mov cl, byte [ebp + 0x18]
push edx
push eax
jmp 0x40629f
mov ebx, dword [esp + 0x14]
mov esi, ebx
and esi, 0x3fff
mov edx, dword [0x4a1b44]
mov byte [edx + 0x11], 2
mov eax, 0x3ffe
cmp si, ax
je 0x40570a
mov ecx, 0x3ffd
cmp si, cx
jne 0x405907
cmp byte [ebp + 0x20], 0
jne 0x405718
mov edx, dword [esp + 0x18]
mov byte [edx + 0xf], 1
test byte [0x4a2c2d], 0xc
jne 0x405738
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 0
call fcn.0040e7b0
add esp, 0x18
mov ebx, dword [ebp + 0x18]
cmp bl, 0xa2
je 0x405745
cmp bl, 0xa3
jne 0x405763
cmp byte [ebp + 0x20], 0
jne 0x405763
mov eax, dword [ebp + 0x1c]
push 0xffc3d44d
push 0
push 0
push eax
push ebx
push 1
call fcn.0040e7b0
add esp, 0x18
mov ecx, dword [0x4a1b44]
mov edx, 0x3ffd
mov byte [ecx + 0xd], 1
cmp si, dx
jne 0x4057a5
test byte [0x4a2c2d], 0x30
jne 0x405797
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 0
call fcn.0040e7b0
add esp, 0x18
mov eax, dword [0x4a1b44]
mov byte [eax + 0xe], 1
jmp 0x40581d
mov ecx, 0x3ffe
cmp si, cx
jne 0x40581d
cmp bl, 0xa0
je 0x4057b9
cmp bl, 0xa1
jne 0x4057d7
cmp byte [ebp + 0x20], 0
jne 0x4057d7
mov edx, dword [ebp + 0x1c]
push 0xffc3d44d
push 0
push 0
push edx
push ebx
push 1
call fcn.0040e7b0
add esp, 0x18
test byte [0x4a2c2d], 0x10
je 0x4057fa
push 0xffc3d44d
push 0
push 0
push 0
push 0xa0
push 1
call fcn.0040e7b0
add esp, 0x18
test byte [0x4a2c2d], 0x20
je 0x40581d
push 0xffc3d44d
push 0
push 0
push 0
push 0xa1
push 1
call fcn.0040e7b0
add esp, 0x18
test byte [0x4a2c2d], 1
je 0x405840
push 0xffc3d44d
push 0
push 0
push 0
push 0xa2
push 1
call fcn.0040e7b0
add esp, 0x18
test byte [0x4a2c2d], 2
je 0x405863
push 0xffc3d44d
push 0
push 0
push 0
push 0xa3
push 1
call fcn.0040e7b0
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push 9
push 2
call fcn.0040e7b0
mov eax, 0x3ffd
add esp, 0x18
cmp si, ax
jne 0x4058c0
mov ecx, dword [0x4a1b44]
cmp byte [ecx + 0xe], 0
je 0x4058c0
cmp bl, 0x60
jb 0x40589a
cmp bl, 0x69
jbe 0x40589f
cmp bl, 0x6e
jne 0x4058c0
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
call fcn.0040e7b0
mov edx, dword [0x4a1b44]
add esp, 0x18
mov byte [edx + 0xe], 0
cmp byte [ebp + 0x20], 0
mov eax, dword [esp + 0x10]
mov byte [eax + 4], 0x68
jne 0x4058d6
mov eax, dword [esp + 0x18]
mov byte [eax + 0x10], 1
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push ecx
push edx
push eax
mov eax, dword [ebp + 8]
mov bl, byte [ebp + 0x20]
mov ecx, dword [ebp + 0x14]
call fcn.004063e0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x3fff
cmp bx, cx
jne 0x405ba7
mov edx, dword [esp + 0x18]
mov cl, byte [edx + 4]
mov al, byte [0x4a2c2e]
mov byte [esp + 0x1d], cl
test cl, cl
je 0x40592d
not cl
and al, cl
mov edi, dword [ebp + 8]
cmp edi, dword [0x4a2d60]
jne 0x40595c
cmp byte [esp + 0x27], 0
je 0x40595c
mov esi, dword [ebp + 0x1c]
movzx edx, al
movzx ecx, si
shl edx, 9
add edx, ecx
mov ecx, dword [0x4a3560]
movzx ebx, word [ecx + edx*2]
mov cl, byte [ebp + 0x18]
jmp 0x405977
mov cl, byte [ebp + 0x18]
movzx edx, al
movzx esi, cl
shl edx, 8
add edx, esi
mov esi, dword [0x4a355c]
movzx ebx, word [esi + edx*2]
mov esi, dword [ebp + 0x1c]
mov edx, 0x3fff
mov dword [esp + 0x14], ebx
cmp bx, dx
jne 0x4059f8
cmp byte [0x4a1b48], 0
je 0x4059f8
cmp cl, 9
je 0x4059f8
and al, 0xf3
cmp edi, dword [0x4a2d60]
jne 0x4059bb
cmp byte [esp + 0x27], 0
je 0x4059bb
mov edx, dword [0x4a3560]
movzx ecx, al
movzx eax, si
shl ecx, 9
add ecx, eax
movzx ebx, word [edx + ecx*2]
jmp 0x4059d0
mov edx, dword [0x4a355c]
movzx eax, al
movzx ecx, cl
shl eax, 8
add eax, ecx
movzx ebx, word [edx + eax*2]
mov eax, ebx
and eax, 0x3fff
mov ecx, 0x3ff9
mov dword [esp + 0x14], ebx
cmp ax, cx
jbe 0x4059ef
mov edx, 0x3fff
cmp ax, dx
jb 0x4059f8
mov ebx, 0x3fff
mov dword [esp + 0x14], ebx
test ebx, 0x4000
je 0x405a52
mov ecx, dword [ebp + 0x20]
test cl, cl
jne 0x405ab7
mov eax, dword [esp + 0x18]
mov word [eax + 6], bx
mov eax, dword [esp + 0x18]
add eax, 6
mov edx, 0x3fff
cmp word [eax], dx
jne 0x405b38
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
push 0
push edx
mov edx, dword [ebp + 0xc]
push eax
push 0
push ecx
mov cl, byte [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edi
mov eax, esi
call fcn.004064d0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, 0x3fff
cmp bx, cx
mov ecx, dword [ebp + 0x20]
je 0x405ac5
mov edx, dword [0x4a0580]
mov eax, ebx
and eax, 0x3fff
test cl, cl
je 0x405a9d
cmp ax, word [edx]
jae 0x405a94
mov edx, dword [0x4a3564]
movzx eax, ax
movzx eax, word [edx + eax*2]
mov edx, 0x3fff
cmp ax, dx
je 0x405a94
mov ebx, eax
mov dword [esp + 0x14], ebx
jmp 0x405ab7
cmp byte [esp + 0x1f], 0
jne 0x405ac5
jmp 0x405ab7
cmp ax, word [edx]
jae 0x405ab7
mov edx, dword [0x4a3564]
movzx eax, ax
mov ax, word [edx + eax*2]
mov edx, dword [esp + 0x18]
mov word [edx + 6], ax
mov eax, 0x3fff
cmp bx, ax
jne 0x405ba7
test cl, cl
je 0x405a13
cmp byte [esp + 0x1d], 0
jne 0x405b0b
mov eax, dword [esp + 0x18]
test byte [eax + 0xb], 1
jne 0x405b0b
cmp byte [eax + 8], 0
je 0x405b0b
cmp byte [esp + 0xf], 0
jne 0x405b0b
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push ecx
push edx
push eax
mov eax, edi
jmp 0x4058f2
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x10]
push 0
push 0x3fff
push edx
mov edx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push ecx
mov cl, byte [ebp + 0x18]
push edi
mov eax, esi
call fcn.004064d0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
push 1
push eax
add ecx, 0xb
xor esi, esi
lea eax, [esp + 0x16]
xor edi, edi
call fcn.00409b10
add esp, 8
cmp byte [esp + 0xe], 0
push edi
je 0x405b79
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0x3fff
push eax
mov eax, dword [ebp + 8]
push edi
push ecx
mov cl, byte [ebp + 0x18]
push edx
push eax
jmp 0x40629f
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push SysReAllocString
push 0x3fff
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
mov eax, dword [ebp + 8]
xor bl, bl
call fcn.004063e0
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x18]
mov al, byte [ecx + 0xb]
add ecx, 0xb
mov dword [esp + 0x30], ecx
test al, 8
je 0x405bc8
cmp byte [ebp + 0x20], 0
je 0x405bc8
and al, 0xf7
mov byte [esp + 0xe], 1
mov byte [ecx], al
mov edx, dword [0x4a0580]
mov ecx, ebx
and ecx, 0x3fff
cmp cx, word [edx]
jae 0x405c30
cmp dword [esp + 0x34], 0
jne 0x405c30
mov eax, dword [ebp + 0x20]
mov ebx, dword [esp + 0x10]
mov edi, dword [ebp + 0x24]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x38]
lea esi, [ebx + 4]
lea eax, [esp + 0x16]
call fcn.00409b10
add esp, 8
mov dword [esp + 0x34], eax
test eax, eax
jne 0x405c2c
mov edx, dword [ebp + 0x20]
mov ecx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
push 0x3fff
push ebx
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
mov cl, byte [ebp + 0x18]
push edx
jmp 0x40629f
mov ebx, dword [esp + 0x14]
mov esi, dword [ebp + 8]
mov ecx, dword [0x4a2d60]
mov dl, byte [0x4a2c2d]
and ebx, 0x3fff
mov edi, ebx
cmp esi, ecx
jne 0x405c80
test dl, 0x3f
jne 0x405ca1
mov eax, dword [0x4a3568]
test dl, 0x40
je 0x405c6a
cmp byte [eax + 0x6668], 0
jne 0x405c6a
mov byte [0x4a1b4c], 1
test dl, dl
jns 0x405ca6
cmp byte [eax + 0x6788], 0
jne 0x405ca6
mov byte [0x4a1b4b], 1
jmp 0x405ca6
test dl, 0xc
jne 0x405ca1
mov eax, dword [0x4a3568]
test dl, 0x40
je 0x405c6a
cmp byte [eax + 0x6668], 0
jne 0x405c6a
mov byte [0x4a1b4c], 1
jmp 0x405ca6
mov eax, dword [0x4a3568]
test dl, 4
je 0x405cd6
cmp byte [eax + 0xb888], 0
jne 0x405cd6
test ecx, ecx
je 0x405cc1
mov byte [0x4a1b4a], 1
jmp 0x405d22
movzx eax, byte [0x49f355]
push 0xffc3d44d
push 0
push 0
push 0
push eax
jmp 0x405d12
test dl, 8
je 0x405d22
cmp byte [eax + 0xb9a8], 0
jne 0x405d22
call fcn.00411260
test al, al
jne 0x405d1c
cmp dword [0x4a2d60], 0
je 0x405cff
mov byte [0x4a1b49], 1
jmp 0x405d1c
movzx ecx, byte [0x49f355]
push 0xffc3d44d
push 0
push 0
push 0
push ecx
push 2
call fcn.0040e7b0
add esp, 0x18
mov dl, byte [0x4a2c2d]
movzx eax, di
lea ecx, [eax - 0x3ffa]
cmp ecx, 4
ja case.default.0x405d34
jmp dword [ecx*4 + 0x4063c0]
cmp byte [0x4a1b48], 0
jne case.0x405d34.16379
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push 0
push 0x3fff
push edx
mov edx, dword [ebp + 0xc]
push eax
push ecx
mov cl, byte [ebp + 0x18]
push edx
push esi
jmp 0x40629f
xor al, al
mov byte [esp + 0xd], al
test dl, 4
je 0x405d74
mov al, 0xa4
jmp 0x405d7b
test dl, 8
je 0x405d7f
mov al, 0xa5
mov byte [esp + 0xd], al
cmp byte [0x4a1b48], 0
je 0x405df5
mov ecx, 0x3ffb
cmp di, cx
je case.0x405d34.16381
test al, al
movzx eax, al
jne 0x405da2
mov eax, 0x12
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 1
call fcn.0040e7b0
mov edx, dword [esp + 0x30]
add esp, 0x18
cmp byte [edx + 4], 0
je 0x405de9
mov eax, dword [ebp + 0x18]
cmp al, 0x5b
je 0x405de9
cmp al, 0x5c
je 0x405de9
cmp byte [ebp + 0x20], 0
jne 0x405de9
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 1
call fcn.0040e7b0
add esp, 0x18
mov byte [0x4a1b48], 0
jmp 0x406052
mov al, byte [ebp + 0x18]
cmp al, 0xa4
je 0x405e05
mov byte [esp + 0x1e], 0
cmp al, 0xa5
jne 0x405e0a
mov byte [esp + 0x1e], 1
cmp al, 0xa0
je 0x405e16
cmp al, 0xa1
je 0x405e16
xor dl, dl
jmp 0x405e18
mov dl, 1
mov byte [esp + 0x1d], dl
cmp al, 0xa2
je 0x405e29
mov byte [esp + 0x1f], 0
cmp al, 0xa3
jne 0x405e2e
mov byte [esp + 0x1f], 1
xor cl, cl
test byte [0x4a2c2d], 0x10
mov byte [esp + 0x2c], cl
je 0x405e41
mov cl, 0xa0
jmp 0x405e5a
test byte [0x4a2c2d], 0x20
je 0x405e4e
mov cl, 0xa1
jmp 0x405e5a
cmp byte [ebp + 0x20], 0
jne 0x405e5e
test dl, dl
je 0x405e5e
mov cl, al
mov byte [esp + 0x2c], cl
mov dl, byte [0x4a2c2d]
mov byte [esp + 0x27], 0
test dl, 1
je 0x405e75
mov byte [esp + 0x27], 0xa2
jmp 0x405e92
test dl, 2
je 0x405e81
mov byte [esp + 0x27], 0xa3
jmp 0x405e92
cmp byte [ebp + 0x20], 0
jne 0x405e92
cmp byte [esp + 0x1f], 0
je 0x405e92
mov byte [esp + 0x27], al
mov esi, dword [esp + 0x2c]
xor bl, bl
test cl, cl
je 0x405eb4
push 0xffc3d44d
push 0
push 0
push 0
push esi
push 1
call fcn.0040e7b0
add esp, 0x18
mov bl, 1
cmp byte [esp + 0x27], 0
je 0x405ed5
mov eax, dword [esp + 0x27]
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 1
call fcn.0040e7b0
add esp, 0x18
cmp byte [esp + 0x1e], 0
je 0x405ee7
cmp byte [ebp + 0x20], 0
jne 0x405eef
mov al, byte [ebp + 0x18]
jmp 0x405eeb
mov al, byte [esp + 0xd]
test al, al
jne 0x405f06
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 0
call fcn.0040e7b0
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push 9
push 2
call fcn.0040e7b0
add esp, 0x18
test bl, bl
je 0x405f3e
cmp byte [esp + 0x1d], 0
jne 0x405f3e
push 0xffc3d44d
push 0
push 0
push 0
push esi
push 0
call fcn.0040e7b0
add esp, 0x18
mov byte [0x4a1b48], 1
jmp 0x406052
cmp byte [0x4a1b48], 0
jne 0x405f74
mov ecx, dword [esp + 0x10]
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x10]
push 0
push 0x3fff
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
mov cl, byte [ebp + 0x18]
push esi
jmp 0x40629f
cmp byte [ebp + 0x20], 0
mov ebx, dword [ebp + 0x18]
jne 0x405fa7
cmp bl, 0xa2
je 0x405f91
cmp bl, 0xa3
je 0x405f91
cmp bl, 0xa0
je 0x405f91
cmp bl, 0xa1
jne 0x405fa7
push 0xffc3d44d
push 0
push 0
push 0
push ebx
push 1
call fcn.0040e7b0
add esp, 0x18
test byte [0x4a2c2d], 0xc
je 0x405fc0
cmp byte [ebp + 0x20], 0
je 0x405fd7
cmp bl, 0xa4
je 0x405fc0
cmp bl, 0xa5
jne 0x405fd7
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 0
call fcn.0040e7b0
add esp, 0x18
mov edx, 0x3ffd
xor bl, bl
cmp di, dx
jne 0x406005
test byte [0x4a2c2d], 0x30
jne 0x406005
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 0
call fcn.0040e7b0
add esp, 0x18
mov bl, 1
push 0xffc3d44d
push 0
push 0
push 0
push 9
push 2
call fcn.0040e7b0
add esp, 0x18
test bl, bl
je 0x406052
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
call fcn.0040e7b0
add esp, 0x18
jmp 0x406052
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
cmp byte [eax + 0x1e], 5
jne 0x406052
movzx eax, word [eax + 0x1c]
shl eax, 0x10
or dword [esp + 0x20], eax
cmp byte [esp + 0xf], 0
mov edi, dword [esp + 0x10]
mov ebx, dword [ebp + 0x20]
mov ecx, dword [esp + 0x18]
mov byte [edi + 4], 0x68
je 0x4060c7
test bl, bl
je 0x4061be
cmp byte [ecx + 8], 0
je 0x4060c7
mov esi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
push 0xffc3d44e
push 0
push 0
push esi
push ebx
push 1
call fcn.0040e7b0
push 0xffc3d44d
push 0
push 0
push esi
push ebx
push 2
call fcn.0040e7b0
mov ecx, dword [esp + 0x50]
mov eax, dword [ebp + 8]
push 0
push SysReAllocString
push ecx
mov ecx, dword [ebp + 0x14]
push edi
push esi
push ebx
mov bl, byte [ebp + 0x20]
call fcn.004063e0
add esp, 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test bl, bl
je 0x4061be
cmp byte [ecx + 4], 0
je 0x40610e
cmp byte [ecx + 0x10], 0
mov edx, dword [esp + 0x20]
je 0x4060f5
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push 0
push SysReAllocString
push edx
push edi
push eax
push ecx
jmp 0x4058ef
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push 1
push edx
mov edx, dword [ebp + 8]
push edi
push ebx
push eax
push ecx
mov cl, byte [ebp + 0x18]
push edx
jmp 0x40629f
cmp byte [esp + 0xe], 0
jne 0x406122
mov eax, dword [esp + 0x30]
test byte [eax], 1
je 0x406256
mov esi, dword [ebp + 8]
cmp esi, dword [0x4a2d64]
jne 0x406147
mov ecx, dword [esp + 0x20]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 0
push ecx
mov cl, byte [ebp + 0x18]
push edi
push ebx
push edx
push eax
push esi
jmp 0x40629f
mov eax, dword [ecx]
test eax, eax
je 0x406156
cmp dword [eax], 7
je 0x406156
mov al, 1
jmp 0x406158
xor al, al
cmp byte [ecx + 0x10], 0
je 0x40619e
cmp byte [esp + 0x2b], 0
jne 0x40619e
test al, al
jne 0x4061a2
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push 0xffc3d44d
push 0
push 0
push ecx
push edx
push 0
call fcn.0040e7b0
add esp, 0x18
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push eax
push edi
push ebx
push ecx
mov cl, byte [ebp + 0x18]
push edx
push esi
jmp 0x40629f
test al, al
je 0x406184
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push 0
push SysReAllocString
push eax
push edi
push ecx
push edx
mov eax, esi
jmp 0x4058f2
mov eax, dword [0x4a1b44]
mov byte [ecx + 0xf], 1
test eax, eax
je 0x4061d5
cmp byte [eax + 4], 0
je 0x4061d5
mov byte [eax + 0x11], 2
cmp byte [esp + 0xe], 0
je 0x406200
mov eax, dword [esp + 0x30]
or byte [eax], 8
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push eax
mov eax, dword [ebp + 8]
push edi
push ebx
push ecx
mov cl, byte [ebp + 0x18]
push edx
push eax
jmp 0x40629f
mov ebx, dword [ebp + 0x18]
cmp bl, 0xa4
je 0x40620d
cmp bl, 0xa5
jne 0x406253
mov al, byte [0x4a2c2d]
test al, 0xc0
je 0x406237
test al, 0x33
jne 0x406237
movzx ecx, byte [0x49f355]
push 0xffc3d44d
push 0
push 0
push 0
push ecx
push 2
call fcn.0040e7b0
add esp, 0x18
mov edx, dword [ebp + 0x1c]
push 0xffc3d44d
push 0
push 0
push edx
push ebx
push 1
call fcn.0040e7b0
mov ecx, dword [esp + 0x30]
add esp, 0x18
mov ebx, dword [ebp + 0x20]
test bl, bl
jne 0x40625e
mov byte [ecx + 0x10], 1
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push 0
push SysReAllocString
push eax
push edi
push ecx
push edx
jmp 0x4058ef
mov ecx, dword [ebp + 0x20]
test cl, cl
sete al
mov byte [esi + 0xf], 0
mov byte [esi + 0xc], al
mov edx, dword [esp + 0x10]
push 0
push 0x3fff
push edx
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
mov cl, bl
push edi
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
call fcn.004064d0
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret