Function at 0x406bc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x44fb4f
mov eax, dword fs:[0]
push eax
mov eax, 0x4da8
call fcn.00447d40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x4dbc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4dcc]
push eax
call fcn.0042af60
push 0x1db04001
push 0x60001
lea ecx, [esp + 0x2ac]
push ecx
sub esp, 0x1c
xor ebp, ebp
mov esi, esp
mov dword [esp + 0x4dec], ebp
mov dword [esi + 0x18], 0xf
mov ebx, 0x10
mov dword [esi + 0x14], ebp
mov dword [esp + 0x44], esp
lea edi, [esi + 4]
cmp dword [esi + 0x18], ebx
jb 0x406c3d
mov eax, dword [edi]
jmp 0x406c3f
mov eax, edi
mov byte [eax], 0
mov eax, dword [esi + 0x18]
cmp eax, ebx
jb 0x406c4d
mov ecx, dword [edi]
jmp 0x406c4f
mov ecx, edi
cmp ecx, 0x454d10
ja 0x406c88
cmp eax, ebx
jb 0x406c5f
mov ecx, dword [edi]
jmp 0x406c61
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x454d10
jbe 0x406c88
cmp eax, ebx
jb 0x406c74
mov edi, dword [edi]
push 0xe
mov eax, 0x454d10
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x406cca
cmp eax, 0xe
jae 0x406c9a
mov ecx, dword [esi + 0x14]
push ecx
push 0xe
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x406ca5
mov eax, dword [edi]
jmp 0x406ca7
mov eax, edi
push 0xe
push 0x454d10
push ecx
push eax
call fcn.00439429
add esp, 0x10
mov dword [esi + 0x14], 0xe
cmp dword [esi + 0x18], ebx
jb 0x406cc6
mov edi, dword [edi]
mov byte [edi + 0xe], 0
lea ecx, [esp + 0x1630]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dd0], 1
call fcn.00401df0
mov ebx, 8
mov byte [esp + 0x4dcc], 2
cmp dword [eax + 0x18], ebx
jb 0x406cfc
mov eax, dword [eax + 4]
jmp 0x406cff
add eax, 4
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
mov dword [esp + 0x40], esp
cmp dword [esi + 0x18], ebx
jb 0x406d1c
mov ecx, dword [esi + 4]
jmp 0x406d1f
lea ecx, [esi + 4]
xor edx, edx
mov word [ecx], dx
mov ecx, eax
lea edi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x406d30
sub ecx, edi
sar ecx, 1
push ecx
call fcn.0040fae0
lea eax, [esp + 0x140]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e08], 3
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
cmp dword [ecx + 0x18], 0x10
mov dword [esp + 0x70], esp
jb 0x406d73
mov eax, dword [ecx + 4]
jmp 0x406d76
lea eax, [ecx + 4]
push 0x24
push 0x454d20
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x31cc]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dec], 4
call fcn.00401df0
mov byte [esp + 0x4de8], 5
cmp dword [eax + 0x18], ebx
jb 0x406db2
mov eax, dword [eax + 4]
jmp 0x406db5
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x6c], esp
call fcn.0040f330
lea ecx, [esp + 0x38c]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e24], 6
mov ecx, esp
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov edi, 0x10
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x84], esp
cmp dword [ecx + 0x18], edi
jb 0x406df9
mov eax, dword [ecx + 4]
jmp 0x406dfc
lea eax, [ecx + 4]
push 0xc
push 0x454d48
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x15b8]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e08], 7
call fcn.00401df0
mov byte [esp + 0x4e04], bl
cmp dword [eax + 0x18], ebx
jb 0x406e37
mov eax, dword [eax + 4]
jmp 0x406e3a
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x80], esp
call fcn.0040f330
lea edx, [esp + 0x140]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e40], 9
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb0], esp
cmp dword [ecx + 0x18], edi
jb 0x406e77
mov eax, dword [ecx + 4]
jmp 0x406e7a
lea eax, [ecx + 4]
push 0x2d
push 0x454d58
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x3fc4]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e24], 0xa
call fcn.00402020
mov byte [esp + 0x4e20], 0xb
cmp dword [eax + 0x18], ebx
jb 0x406eb6
mov eax, dword [eax + 4]
jmp 0x406eb9
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xac], esp
call fcn.0040f330
lea eax, [esp + 0x2e4]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0xc
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb0], esp
cmp dword [ecx + 0x18], edi
jb 0x406ef6
mov eax, dword [ecx + 4]
jmp 0x406ef9
lea eax, [ecx + 4]
push 0xc
push str._eE
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x1540]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e40], 0xd
call fcn.00402020
mov byte [esp + 0x4e3c], 0xe
cmp dword [eax + 0x18], ebx
jb 0x406f35
mov eax, dword [eax + 4]
jmp 0x406f38
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xac], esp
call fcn.0040f330
lea ecx, [esp + 0x140]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e78], 0xf
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xd4], esp
cmp dword [ecx + 0x18], edi
jb 0x406f75
mov eax, dword [ecx + 4]
jmp 0x406f78
lea eax, [ecx + 4]
push 0xd
push 0x454d98
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x318c]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e5c], 0x10
call fcn.00402020
mov byte [esp + 0x4e58], 0x11
cmp dword [eax + 0x18], ebx
jb 0x406fb4
mov eax, dword [eax + 4]
jmp 0x406fb7
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xd0], esp
call fcn.0040f330
lea edx, [esp + 0x4a4]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e94], 0x12
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xf8], esp
cmp dword [ecx + 0x18], edi
jb 0x406ff4
mov eax, dword [ecx + 4]
jmp 0x406ff7
lea eax, [ecx + 4]
push 0x15
push 0x454da8
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x14c8]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e78], 0x13
call fcn.00401df0
mov byte [esp + 0x4e74], 0x14
cmp dword [eax + 0x18], ebx
jb 0x407033
mov eax, dword [eax + 4]
jmp 0x407036
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf4], esp
call fcn.0040f330
lea eax, [esp + 0x140]
push eax
sub esp, 0x1c
mov byte [esp + 0x4eb0], 0x15
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x11c], esp
cmp dword [ecx + 0x18], edi
jb 0x407073
mov eax, dword [ecx + 4]
jmp 0x407076
lea eax, [ecx + 4]
push 9
push 0x454dc0
mov byte [eax], 0
call fcn.004030c0
lea esi, [esp + 0x4714]
call fcn.004016b0
mov byte [esp + 0x4e94], 0x16
call fcn.00401ad0
mov byte [esp + 0x4e90], 0x17
cmp dword [eax + 0x18], edi
jb 0x4070b0
mov eax, dword [eax + 4]
jmp 0x4070b3
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x118], esp
push eax
call fcn.00404230
lea ecx, [esp + 0x2ac]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4ecc], 0x18
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x140], esp
cmp dword [ecx + 0x18], edi
jb 0x4070f5
mov eax, dword [ecx + 4]
jmp 0x4070f8
lea eax, [ecx + 4]
push 0xc
push 0x454dcc
mov byte [eax], 0
call fcn.004030c0
lea esi, [esp + 0x1a80]
call fcn.004016b0
mov byte [esp + 0x4eb0], 0x19
call fcn.00401930
mov byte [esp + 0x4eac], 0x1a
cmp dword [eax + 0x18], edi
jb 0x407132
mov eax, dword [eax + 4]
jmp 0x407135
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], esp
push eax
call fcn.00404230
mov ecx, dword [esp + 0x4ed0]
mov byte [esp + 0x4ec8], 0x2a
call fcn.0040d4f0
cmp dword [esp + 0x1dc], edi
jb 0x407174
mov edx, dword [esp + 0x1c8]
push edx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x1978]
mov dword [esp + 0x1dc], 0xf
mov dword [esp + 0x1d8], ebp
mov byte [esp + 0x1c8], 0
call fcn.00429e20
cmp dword [esp + 0x8c], edi
jb 0x4071b0
mov eax, dword [esp + 0x78]
push eax
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x4628]
mov dword [esp + 0x8c], 0xf
mov dword [esp + 0x88], ebp
mov byte [esp + 0x78], 0
call fcn.00429e20
cmp dword [esp + 0x40c], ebx
jb 0x4071ec
mov ecx, dword [esp + 0x3f8]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x13f8]
mov dword [esp + 0x40c], 7
mov dword [esp + 0x408], ebp
mov word [esp + 0x3f8], dx
call fcn.00429e20
cmp dword [esp + 0xc4], ebx
jb 0x40722d
mov eax, dword [esp + 0xb0]
push eax
call fcn.004393c9
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x30d8]
mov dword [esp + 0xc4], 7
mov dword [esp + 0xc0], ebp
mov word [esp + 0xb0], cx
call fcn.00429e20
cmp dword [esp + 0x284], ebx
jb 0x40726e
mov edx, dword [esp + 0x270]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
lea esi, [esp + 0x14a8]
mov dword [esp + 0x284], 7
mov dword [esp + 0x280], ebp
mov word [esp + 0x270], ax
call fcn.00429e20
cmp dword [esp + 0xfc], ebx
jb 0x4072af
mov ecx, dword [esp + 0xe8]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x3f48]
mov dword [esp + 0xfc], 7
mov dword [esp + 0xf8], ebp
mov word [esp + 0xe8], dx
call fcn.00429e20
cmp dword [esp + 0x364], ebx
jb 0x4072f0
mov eax, dword [esp + 0x350]
push eax
call fcn.004393c9
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x1558]
mov dword [esp + 0x364], 7
mov dword [esp + 0x360], ebp
mov word [esp + 0x350], cx
call fcn.00429e20
cmp dword [esp + 0x134], ebx
jb 0x407331
mov edx, dword [esp + 0x120]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
lea esi, [esp + 0x3188]
mov dword [esp + 0x134], 7
mov dword [esp + 0x130], ebp
mov word [esp + 0x120], ax
call fcn.00429e20
cmp dword [esp + 0x2bc], ebx
jb 0x407372
mov ecx, dword [esp + 0x2a8]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x1608]
mov dword [esp + 0x2bc], 7
mov dword [esp + 0x2b8], ebp
mov word [esp + 0x2a8], dx
call fcn.00429e20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x4073af
sub eax, 2
je 0x4073af
sub eax, 4
jne 0x4073b9
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.00430090
push 0x1db04001
push 0x70002
lea eax, [esp + 0x23c]
push eax
sub esp, 0x1c
mov dword [esp + 0x4dec], ebp
mov ecx, esp
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x60], esp
cmp dword [ecx + 0x18], edi
jb 0x4073f5
mov eax, dword [ecx + 4]
jmp 0x4073f8
lea eax, [ecx + 4]
push esi
push 0x454ddc
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x4700]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dd0], 0x2f
call fcn.00402020
mov byte [esp + 0x4dcc], 0x30
cmp dword [eax + 0x18], ebx
jb 0x407433
mov eax, dword [eax + 4]
jmp 0x407436
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
call fcn.0040f330
lea ecx, [esp + 0x338]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e08], 0x31
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x74], esp
cmp dword [ecx + 0x18], edi
jb 0x40746d
mov eax, dword [ecx + 4]
jmp 0x407470
lea eax, [ecx + 4]
push 0x1f
push 0x454dec
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x190c]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dec], 0x32
call fcn.004024d0
mov byte [esp + 0x4de8], 0x33
cmp dword [eax + 0x18], ebx
jb 0x4074ac
mov eax, dword [eax + 4]
jmp 0x4074af
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.0040f330
lea edx, [esp + 0x23c]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e24], 0x34
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x88], esp
cmp dword [ecx + 0x18], edi
jb 0x4074e9
mov eax, dword [ecx + 4]
jmp 0x4074ec
lea eax, [ecx + 4]
push 0xd
push 0x454e0c
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x3348]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e08], 0x35
call fcn.004024d0
mov byte [esp + 0x4e04], 0x36
cmp dword [eax + 0x18], ebx
jb 0x407528
mov eax, dword [eax + 4]
jmp 0x40752b
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x84], esp
call fcn.0040f330
lea eax, [esp + 0x3e0]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e40], 0x37
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x9c], esp
cmp dword [ecx + 0x18], edi
jb 0x407568
mov eax, dword [ecx + 4]
jmp 0x40756b
lea eax, [ecx + 4]
push 0x2d
push 0x454e1c
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x1894]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e24], 0x38
call fcn.00402280
mov byte [esp + 0x4e20], 0x39
cmp dword [eax + 0x18], ebx
jb 0x4075a7
mov eax, dword [eax + 4]
jmp 0x4075aa
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x98], esp
call fcn.0040f330
lea ecx, [esp + 0xb4]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0x3a
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb0], esp
cmp dword [ecx + 0x18], edi
jb 0x4075e7
mov eax, dword [ecx + 4]
jmp 0x4075ea
lea eax, [ecx + 4]
push 5
push 0x454e4c
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x4090]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e40], 0x3b
call fcn.00401df0
mov byte [esp + 0x4e3c], 0x3c
cmp dword [eax + 0x18], ebx
jb 0x407626
mov eax, dword [eax + 4]
jmp 0x407629
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xac], esp
call fcn.0040f330
lea edx, [esp + 0x370]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e78], 0x3d
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xe8], esp
cmp dword [ecx + 0x18], edi
jb 0x407666
mov eax, dword [ecx + 4]
jmp 0x407669
lea eax, [ecx + 4]
push 0x2e
push 0x454e54
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x181c]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e5c], 0x3e
call fcn.00402280
mov byte [esp + 0x4e58], 0x3f
cmp dword [eax + 0x18], ebx
jb 0x4076a5
mov eax, dword [eax + 4]
jmp 0x4076a8
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xe4], esp
call fcn.0040f330
lea eax, [esp + 0x23c]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e94], 0x40
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xf4], esp
cmp dword [ecx + 0x18], edi
jb 0x4076e5
mov eax, dword [ecx + 4]
jmp 0x4076e8
lea eax, [ecx + 4]
push 0x15
push 0x454e84
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x3308]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e78], 0x41
call fcn.00402280
mov byte [esp + 0x4e74], 0x42
cmp dword [eax + 0x18], ebx
jb 0x407724
mov eax, dword [eax + 4]
jmp 0x407727
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf0], esp
call fcn.0040f330
lea ecx, [esp + 0x488]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4eb0], 0x43
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x118], esp
cmp dword [ecx + 0x18], edi
jb 0x407764
mov eax, dword [ecx + 4]
jmp 0x407767
lea eax, [ecx + 4]
push 0x1c
push 0x454e9c
mov byte [eax], 0
call fcn.004030c0
lea esi, [esp + 0x17a4]
call fcn.004016b0
mov byte [esp + 0x4e94], 0x44
call fcn.00401ad0
mov byte [esp + 0x4e90], 0x45
cmp dword [eax + 0x18], edi
jb 0x4077a1
mov eax, dword [eax + 4]
jmp 0x4077a4
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x114], esp
push eax
call fcn.00404230
lea edx, [esp + 0x23c]
push edx
sub esp, 0x1c
mov byte [esp + 0x4ecc], 0x46
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x124], esp
cmp dword [ecx + 0x18], edi
jb 0x4077e6
mov eax, dword [ecx + 4]
jmp 0x4077e9
lea eax, [ecx + 4]
push 9
push 0x454ebc
mov byte [eax], 0
call fcn.004030c0
lea esi, [esp + 0x4cb0]
call fcn.004016b0
mov byte [esp + 0x4eb0], 0x47
call fcn.00401ad0
mov byte [esp + 0x4eac], 0x48
cmp dword [eax + 0x18], edi
jb 0x407823
mov eax, dword [eax + 4]
jmp 0x407826
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x120], esp
push eax
call fcn.00404230
mov ecx, dword [esp + 0x4ed0]
mov byte [esp + 0x4ec8], 0x58
call fcn.0040d4f0
cmp dword [esp + 0x16c], edi
jb 0x407865
mov eax, dword [esp + 0x158]
push eax
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x4ba8]
mov dword [esp + 0x16c], 0xf
mov dword [esp + 0x168], ebp
mov byte [esp + 0x158], 0
call fcn.00429e20
cmp dword [esp + 0x3d4], edi
jb 0x4078a4
mov ecx, dword [esp + 0x3c0]
push ecx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x16b8]
mov dword [esp + 0x3d4], 0xf
mov dword [esp + 0x3d0], ebp
mov byte [esp + 0x3c0], 0
call fcn.00429e20
cmp dword [esp + 0x1a4], ebx
jb 0x4078e3
mov edx, dword [esp + 0x190]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
lea esi, [esp + 0x3238]
mov dword [esp + 0x1a4], 7
mov dword [esp + 0x1a0], ebp
mov word [esp + 0x190], ax
call fcn.00429e20
cmp dword [esp + 0x2f4], ebx
jb 0x407924
mov ecx, dword [esp + 0x2e0]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x1768]
mov dword [esp + 0x2f4], 7
mov dword [esp + 0x2f0], ebp
mov word [esp + 0x2e0], dx
call fcn.00429e20
cmp dword [esp + 0x54], ebx
jb 0x40795f
mov eax, dword [esp + 0x40]
push eax
call fcn.004393c9
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x3ff8]
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebp
mov word [esp + 0x40], cx
call fcn.00429e20
cmp dword [esp + 0x39c], ebx
jb 0x407997
mov edx, dword [esp + 0x388]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
lea esi, [esp + 0x1818]
mov dword [esp + 0x39c], 7
mov dword [esp + 0x398], ebp
mov word [esp + 0x388], ax
call fcn.00429e20
cmp dword [esp + 0x214], ebx
jb 0x4079d8
mov ecx, dword [esp + 0x200]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x32e8]
mov dword [esp + 0x214], 7
mov dword [esp + 0x210], ebp
mov word [esp + 0x200], dx
call fcn.00429e20
cmp dword [esp + 0x32c], ebx
jb 0x407a19
mov eax, dword [esp + 0x318]
push eax
call fcn.004393c9
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x18c8]
mov dword [esp + 0x32c], 7
mov dword [esp + 0x328], ebp
mov word [esp + 0x318], cx
call fcn.00429e20
cmp dword [esp + 0x24c], ebx
jb 0x407a5a
mov edx, dword [esp + 0x238]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
lea esi, [esp + 0x46d8]
mov dword [esp + 0x24c], 7
mov dword [esp + 0x248], ebp
mov word [esp + 0x238], ax
mov byte [esp + 0x4dc4], al
call fcn.00429e20
call fcn.004300d0
test eax, eax
je 0x407a9c
call fcn.00406630
call fcn.004066e0
push 0xa281588
push 0x50001
lea ecx, [esp + 0x220]
push ecx
sub esp, 0x1c
mov ecx, esp
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x60], esp
cmp dword [ecx + 0x18], edi
jb 0x407acc
mov eax, dword [ecx + 4]
jmp 0x407acf
lea eax, [ecx + 4]
push 0xd
push 0x454ec8
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x1c60]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dd0], 0x59
call fcn.00401df0
mov byte [esp + 0x4dcc], 0x5a
cmp dword [eax + 0x18], ebx
jb 0x407b0b
mov eax, dword [eax + 4]
jmp 0x407b0e
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
call fcn.0040f330
lea edx, [esp + 0x204]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e08], 0x5b
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x74], esp
cmp dword [ecx + 0x18], edi
jb 0x407b45
mov eax, dword [ecx + 4]
jmp 0x407b48
lea eax, [ecx + 4]
push 0x24
push 0x454ed8
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x4a8c]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dec], 0x5c
call fcn.004028a0
mov byte [esp + 0x4de8], 0x5d
cmp dword [eax + 0x18], ebx
jb 0x407b84
mov eax, dword [eax + 4]
jmp 0x407b87
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.0040f330
lea eax, [esp + 0x1e8]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e24], 0x5e
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x88], esp
cmp dword [ecx + 0x18], edi
jb 0x407bc1
mov eax, dword [ecx + 4]
jmp 0x407bc4
lea eax, [ecx + 4]
push 0xb
push 0x454f00
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x1be8]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e08], 0x5f
call fcn.00401df0
mov byte [esp + 0x4e04], 0x60
cmp dword [eax + 0x18], ebx
jb 0x407c00
mov eax, dword [eax + 4]
jmp 0x407c03
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x84], esp
call fcn.0040f330
lea ecx, [esp + 0x1cc]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e40], 0x61
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x9c], esp
cmp dword [ecx + 0x18], edi
jb 0x407c40
mov eax, dword [ecx + 4]
jmp 0x407c43
lea eax, [ecx + 4]
push 0x2d
push 0x454f0c
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x34c4]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e24], 0x62
call fcn.00401df0
mov byte [esp + 0x4e20], 0x63
cmp dword [eax + 0x18], ebx
jb 0x407c7f
mov eax, dword [eax + 4]
jmp 0x407c82
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x98], esp
call fcn.0040f330
lea edx, [esp + 0x1b0]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0x64
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb0], esp
cmp dword [ecx + 0x18], edi
jb 0x407cbf
mov eax, dword [ecx + 4]
jmp 0x407cc2
lea eax, [ecx + 4]
push 0xb
push 0x454f3c
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x1b70]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e40], 0x65
call fcn.004028a0
mov byte [esp + 0x4e3c], 0x66
cmp dword [eax + 0x18], ebx
jb 0x407cfe
mov eax, dword [eax + 4]
jmp 0x407d01
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xac], esp
call fcn.0040f330
lea eax, [esp + 0x194]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e78], 0x67
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xe8], esp
cmp dword [ecx + 0x18], edi
jb 0x407d3e
mov eax, dword [ecx + 4]
jmp 0x407d41
lea eax, [ecx + 4]
push 0x15
push 0x454f48
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x415c]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e5c], 0x68
call fcn.00402280
mov byte [esp + 0x4e58], 0x69
cmp dword [eax + 0x18], ebx
jb 0x407d7d
mov eax, dword [eax + 4]
jmp 0x407d80
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xe4], esp
call fcn.0040f330
lea ecx, [esp + 0x178]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e94], 0x6a
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xf4], esp
cmp dword [ecx + 0x18], edi
jb 0x407dbd
mov eax, dword [ecx + 4]
jmp 0x407dc0
lea eax, [ecx + 4]
push 0x15
push 0x454da8
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x1af8]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e78], 0x6b
call fcn.00401df0
mov byte [esp + 0x4e74], 0x6c
cmp dword [eax + 0x18], ebx
jb 0x407dfc
mov eax, dword [eax + 4]
jmp 0x407dff
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf0], esp
call fcn.0040f330
lea edx, [esp + 0x15c]
push edx
sub esp, 0x1c
mov byte [esp + 0x4eb0], 0x6d
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x118], esp
cmp dword [ecx + 0x18], edi
jb 0x407e3c
mov eax, dword [ecx + 4]
jmp 0x407e3f
lea eax, [ecx + 4]
push 7
push 0x454f60
mov byte [eax], 0
call fcn.004030c0
lea esi, [esp + 0x3484]
call fcn.004016b0
mov byte [esp + 0x4e94], 0x6e
call fcn.00401770
mov byte [esp + 0x4e90], 0x6f
cmp dword [eax + 0x18], edi
jb 0x407e79
mov eax, dword [eax + 4]
jmp 0x407e7c
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x114], esp
push eax
call fcn.00404230
lea eax, [esp + 0x140]
push eax
sub esp, 0x1c
mov byte [esp + 0x4ecc], 0x70
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x124], esp
cmp dword [ecx + 0x18], edi
jb 0x407ebe
mov eax, dword [ecx + 4]
jmp 0x407ec1
lea eax, [ecx + 4]
push 0xb
push 0x454f68
mov byte [eax], 0
call fcn.004030c0
lea esi, [esp + 0x13f8]
call fcn.004016b0
mov byte [esp + 0x4eb0], 0x71
call fcn.00401ca0
mov byte [esp + 0x4eac], 0x72
cmp dword [eax + 0x18], edi
jb 0x407efb
mov eax, dword [eax + 4]
jmp 0x407efe
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x120], esp
push eax
call fcn.00404230
mov ecx, dword [esp + 0x4ed0]
mov byte [esp + 0x4ec8], 0x82
call fcn.0040d4f0
cmp dword [esp + 0x70], edi
jb 0x407f37
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x12f0]
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebp
mov byte [esp + 0x5c], 0
call fcn.00429e20
cmp dword [esp + 0xa8], edi
jb 0x407f6d
mov edx, dword [esp + 0x94]
push edx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x3398]
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], ebp
mov byte [esp + 0x94], 0
call fcn.00429e20
cmp dword [esp + 0xe0], ebx
jb 0x407fac
mov eax, dword [esp + 0xcc]
push eax
call fcn.004393c9
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x1a28]
mov dword [esp + 0xe0], 7
mov dword [esp + 0xdc], ebp
mov word [esp + 0xcc], cx
call fcn.00429e20
cmp dword [esp + 0x118], ebx
jb 0x407fed
mov edx, dword [esp + 0x104]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
lea esi, [esp + 0x40a8]
mov dword [esp + 0x118], 7
mov dword [esp + 0x114], ebp
mov word [esp + 0x104], ax
call fcn.00429e20
cmp dword [esp + 0x150], ebx
jb 0x40802e
mov ecx, dword [esp + 0x13c]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x1ad8]
mov dword [esp + 0x150], 7
mov dword [esp + 0x14c], ebp
mov word [esp + 0x13c], dx
call fcn.00429e20
cmp dword [esp + 0x188], ebx
jb 0x40806f
mov eax, dword [esp + 0x174]
push eax
call fcn.004393c9
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x3448]
mov dword [esp + 0x188], 7
mov dword [esp + 0x184], ebp
mov word [esp + 0x174], cx
call fcn.00429e20
cmp dword [esp + 0x1c0], ebx
jb 0x4080b0
mov edx, dword [esp + 0x1ac]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
lea esi, [esp + 0x1b88]
mov dword [esp + 0x1c0], 7
mov dword [esp + 0x1bc], ebp
mov word [esp + 0x1ac], ax
call fcn.00429e20
cmp dword [esp + 0x1f8], ebx
jb 0x4080f1
mov ecx, dword [esp + 0x1e4]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x4a48]
mov dword [esp + 0x1f8], 7
mov dword [esp + 0x1f4], ebp
mov word [esp + 0x1e4], dx
call fcn.00429e20
cmp dword [esp + 0x230], ebx
jb 0x408132
mov eax, dword [esp + 0x21c]
push eax
call fcn.004393c9
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x1c38]
mov dword [esp + 0x230], 7
mov dword [esp + 0x22c], ebp
mov word [esp + 0x21c], cx
mov byte [esp + 0x4dc4], cl
call fcn.00429e20
push 0x1db04001
push 0x60001
lea edx, [esp + 0x418]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x60], esp
cmp dword [ecx + 0x18], edi
jb 0x408190
mov eax, dword [ecx + 4]
jmp 0x408193
lea eax, [ecx + 4]
push 0xe
push 0x454f74
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x3680]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dd0], 0x83
call fcn.004028a0
mov byte [esp + 0x4dcc], 0x84
cmp dword [eax + 0x18], ebx
jb 0x4081cf
mov eax, dword [eax + 4]
jmp 0x4081d2
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
call fcn.0040f330
lea eax, [esp + 0x3fc]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e08], 0x85
mov ecx, esp
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x74], esp
cmp dword [ecx + 0x18], edi
jb 0x40820e
mov eax, dword [ecx + 4]
jmp 0x408211
lea eax, [ecx + 4]
push 0x24
push 0x454f84
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x1f3c]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dec], 0x86
call fcn.00402280
mov byte [esp + 0x4de8], 0x87
cmp dword [eax + 0x18], ebx
jb 0x40824d
mov eax, dword [eax + 4]
jmp 0x408250
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.0040f330
lea ecx, [esp + 0x3e0]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e24], 0x88
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x88], esp
cmp dword [ecx + 0x18], edi
jb 0x40828a
mov eax, dword [ecx + 4]
jmp 0x40828d
lea eax, [ecx + 4]
push 0xc
push 0x454fac
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x47e8]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e08], 0x89
call fcn.004024d0
mov byte [esp + 0x4e04], 0x8a
cmp dword [eax + 0x18], ebx
jb 0x4082c9
mov eax, dword [eax + 4]
jmp 0x4082cc
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x84], esp
call fcn.0040f330
lea edx, [esp + 0x3c4]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e40], 0x8b
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x9c], esp
cmp dword [ecx + 0x18], edi
jb 0x408309
mov eax, dword [ecx + 4]
jmp 0x40830c
lea eax, [ecx + 4]
push 0x2d
push 0x454fbc
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x1ec4]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e24], 0x8c
call fcn.004028a0
mov byte [esp + 0x4e20], 0x8d
cmp dword [eax + 0x18], ebx
jb 0x408348
mov eax, dword [eax + 4]
jmp 0x40834b
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x98], esp
call fcn.0040f330
lea eax, [esp + 0x3a8]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0x8e
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb0], esp
cmp dword [ecx + 0x18], edi
jb 0x408388
mov eax, dword [ecx + 4]
jmp 0x40838b
lea eax, [ecx + 4]
push 0xc
push 0x454fac
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x3640]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e40], 0x8f
call fcn.004024d0
mov byte [esp + 0x4e3c], 0x90
cmp dword [eax + 0x18], ebx
jb 0x4083c7
mov eax, dword [eax + 4]
jmp 0x4083ca
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xac], esp
call fcn.0040f330
lea ecx, [esp + 0x38c]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e78], 0x91
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xe8], esp
cmp dword [ecx + 0x18], edi
jb 0x408407
mov eax, dword [ecx + 4]
jmp 0x40840a
lea eax, [ecx + 4]
push 0x3f
push 0x454ff0
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x1e4c]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e5c], 0x92
call fcn.004028a0
mov byte [esp + 0x4e58], 0x93
cmp dword [eax + 0x18], ebx
jb 0x408446
mov eax, dword [eax + 4]
jmp 0x408449
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xe4], esp
call fcn.0040f330
lea edx, [esp + 0x370]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e94], 0x94
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xf4], esp
cmp dword [ecx + 0x18], edi
jb 0x408486
mov eax, dword [ecx + 4]
jmp 0x408489
lea eax, [ecx + 4]
push 0x15
push 0x455030
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x4228]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e78], 0x95
call fcn.004028a0
mov byte [esp + 0x4e74], 0x96
cmp dword [eax + 0x18], ebx
jb 0x4084c5
mov eax, dword [eax + 4]
jmp 0x4084c8
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf0], esp
call fcn.0040f330
lea eax, [esp + 0x354]
push eax
sub esp, 0x1c
mov byte [esp + 0x4eb0], 0x97
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x118], esp
cmp dword [ecx + 0x18], edi
jb 0x408505
mov eax, dword [ecx + 4]
jmp 0x408508
lea eax, [ecx + 4]
push ebx
push 0x455048
mov byte [eax], 0
call fcn.004030c0
lea esi, [esp + 0x1dd4]
call fcn.004016b0
mov byte [esp + 0x4e94], 0x98
call fcn.00401850
mov byte [esp + 0x4e90], 0x99
cmp dword [eax + 0x18], edi
jb 0x408541
mov eax, dword [eax + 4]
jmp 0x408544
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x114], esp
push eax
call fcn.00404230
lea ecx, [esp + 0x338]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4ecc], 0x9a
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x124], esp
cmp dword [ecx + 0x18], edi
jb 0x408586
mov eax, dword [ecx + 4]
jmp 0x408589
lea eax, [ecx + 4]
push 0xc
push 0x455054
mov byte [eax], 0
call fcn.004030c0
lea esi, [esp + 0x3600]
call fcn.004016b0
mov byte [esp + 0x4eb0], 0x9b
call fcn.00401770
mov byte [esp + 0x4eac], 0x9c
cmp dword [eax + 0x18], edi
jb 0x4085c3
mov eax, dword [eax + 4]
jmp 0x4085c6
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x120], esp
push eax
call fcn.00404230
mov ecx, dword [esp + 0x4ed0]
mov byte [esp + 0x4ec8], 0xac
call fcn.0040d4f0
cmp dword [esp + 0x268], edi
jb 0x408605
mov edx, dword [esp + 0x254]
push edx
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x34f8]
mov dword [esp + 0x268], 0xf
mov dword [esp + 0x264], ebp
mov byte [esp + 0x254], 0
call fcn.00429e20
cmp dword [esp + 0x2a0], edi
jb 0x408644
mov eax, dword [esp + 0x28c]
push eax
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x1ce8]
mov dword [esp + 0x2a0], 0xf
mov dword [esp + 0x29c], ebp
mov byte [esp + 0x28c], 0
call fcn.00429e20
cmp dword [esp + 0x2d8], ebx
jb 0x408683
mov ecx, dword [esp + 0x2c4]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x4158]
mov dword [esp + 0x2d8], 7
mov dword [esp + 0x2d4], ebp
mov word [esp + 0x2c4], dx
call fcn.00429e20
cmp dword [esp + 0x310], ebx
jb 0x4086c4
mov eax, dword [esp + 0x2fc]
push eax
call fcn.004393c9
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x1d98]
mov dword [esp + 0x310], 7
mov dword [esp + 0x30c], ebp
mov word [esp + 0x2fc], cx
call fcn.00429e20
cmp dword [esp + 0x348], ebx
jb 0x408705
mov edx, dword [esp + 0x334]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
lea esi, [esp + 0x35a8]
mov dword [esp + 0x348], 7
mov dword [esp + 0x344], ebp
mov word [esp + 0x334], ax
call fcn.00429e20
cmp dword [esp + 0x380], ebx
jb 0x408746
mov ecx, dword [esp + 0x36c]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x1e48]
mov dword [esp + 0x380], 7
mov dword [esp + 0x37c], ebp
mov word [esp + 0x36c], dx
call fcn.00429e20
cmp dword [esp + 0x3b8], ebx
jb 0x408787
mov eax, dword [esp + 0x3a4]
push eax
call fcn.004393c9
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x4788]
mov dword [esp + 0x3b8], 7
mov dword [esp + 0x3b4], ebp
mov word [esp + 0x3a4], cx
call fcn.00429e20
cmp dword [esp + 0x3f0], ebx
jb 0x4087c8
mov edx, dword [esp + 0x3dc]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
lea esi, [esp + 0x1ef8]
mov dword [esp + 0x3f0], 7
mov dword [esp + 0x3ec], ebp
mov word [esp + 0x3dc], ax
call fcn.00429e20
cmp dword [esp + 0x428], ebx
jb 0x408809
mov ecx, dword [esp + 0x414]
push ecx
call fcn.004393c9
add esp, 4
xor edx, edx
lea esi, [esp + 0x3658]
mov dword [esp + 0x428], 7
mov dword [esp + 0x424], ebp
mov word [esp + 0x414], dx
mov byte [esp + 0x4dc4], dl
call fcn.00429e20
call fcn.004065f0
test eax, eax
je 0x408846
call fcn.00418100
call fcn.004065c0
push 0x1db04001
push 0x60001
lea eax, [esp + 0x530]
push eax
sub esp, 0x1c
mov dword [esp + 0x4dec], ebp
mov ecx, esp
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x60], esp
cmp dword [ecx + 0x18], edi
jb 0x408882
mov eax, dword [ecx + 4]
jmp 0x408885
lea eax, [ecx + 4]
push 0xe
push 0x455064
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x2290]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dd0], 0xaf
call fcn.00402280
mov byte [esp + 0x4dcc], 0xb0
cmp dword [eax + 0x18], ebx
jb 0x4088c1
mov eax, dword [eax + 4]
jmp 0x4088c4
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
call fcn.0040f330
lea ecx, [esp + 0xc14]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e08], 0xb1
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x74], esp
cmp dword [ecx + 0x18], edi
jb 0x4088fb
mov eax, dword [ecx + 4]
jmp 0x4088fe
lea eax, [ecx + 4]
push 0x24
push 0x455074
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x37fc]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4dec], 0xb2
call fcn.004024d0
mov byte [esp + 0x4de8], 0xb3
cmp dword [eax + 0x18], ebx
jb 0x40893a
mov eax, dword [eax + 4]
jmp 0x40893d
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.0040f330
lea edx, [esp + 0x530]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e24], 0xb4
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x88], esp
cmp dword [ecx + 0x18], edi
jb 0x408977
mov eax, dword [ecx + 4]
jmp 0x40897a
lea eax, [ecx + 4]
push 9
push 0x45509c
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x2218]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e08], 0xb5
call fcn.00401df0
mov byte [esp + 0x4e04], 0xb6
cmp dword [eax + 0x18], ebx
jb 0x4089b6
mov eax, dword [eax + 4]
jmp 0x4089b9
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x84], esp
call fcn.0040f330
lea eax, [esp + 0x1314]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e40], 0xb7
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x9c], esp
cmp dword [ecx + 0x18], edi
jb 0x4089f6
mov eax, dword [ecx + 4]
jmp 0x4089f9
lea eax, [ecx + 4]
push 0x2d
push 0x454d58
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x4d84]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e24], 0xb8
call fcn.00402020
mov byte [esp + 0x4e20], 0xb9
cmp dword [eax + 0x18], ebx
jb 0x408a35
mov eax, dword [eax + 4]
jmp 0x408a38
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x98], esp
call fcn.0040f330
lea ecx, [esp + 0x530]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0xba
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb0], esp
cmp dword [ecx + 0x18], edi
jb 0x408a75
mov eax, dword [ecx + 4]
jmp 0x408a78
lea eax, [ecx + 4]
push 9
push 0x4550a8
mov byte [eax], 0
call fcn.004030c0
lea ecx, [esp + 0x21a0]
call fcn.004062e0
mov ecx, eax
mov byte [esp + 0x4e40], 0xbb
call fcn.00402280
mov byte [esp + 0x4e3c], 0xbc
cmp dword [eax + 0x18], ebx
jb 0x408ab4
mov eax, dword [eax + 4]
jmp 0x408ab7
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xac], esp
call fcn.0040f330
lea edx, [esp + 0xc4c]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e78], 0xbd
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xe8], esp
cmp dword [ecx + 0x18], edi
jb 0x408af4