Function at 0x40c8e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x2094
call fcn.0043f4b0
mov eax, dword [0x46e040]
xor eax, esp
mov dword [esp + 0x208c], eax
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov edx, dword [ebx + 4]
mov edi, dword [ebx]
test edx, edx
jne 0x40c910
cmp edi, 0x16
jb 0x40d759
mov ebp, edi
mov ecx, edx
sub ebp, 0x1000
sbb ecx, 0
mov dword [esp + 0x14], ecx
js 0x40c929
jg 0x40c940
test ebp, ebp
jne 0x40c940
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
nop
mov eax, edi
sub eax, ebp
sbb edx, ecx
mov dword [esp + 0x2c], edx
ja 0x40c957
cmp eax, 0x1000
ja 0x40c957
sub edi, ebp
jmp 0x40c95c
mov edi, 0x1000
mov esi, dword [ebx + 0x38]
lea eax, [esp + 0x1098]
push edi
push eax
push ecx
push ebp
push dword [ebx + 0x44]
mov ecx, esi
call dword [0x44227c]
call esi
cmp eax, edi
jne 0x40d762
lea esi, [edi - 4]
test esi, esi
js 0x40ca04
lea edx, [esp + 0x1099]
lea edi, [esp + 0x1098]
lea eax, ds:[esp + 0x109b]
movzx ecx, byte [eax + esi]
movzx eax, byte [esp + esi + 0x109a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + esi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x40c9f7
mov edi, dword ds:[ebx]
mov eax, esi
mov ecx, dword [ebx + 4]
sub edi, ebp
cdq
sbb ecx, dword [esp + 0x14]
sub edi, eax
sbb ecx, edx
mov dword [esp + 0x2c], ecx
jne 0x40c9fe
jb 0x40c9e9
cmp edi, 0x16
jae 0x40c9fe
lea edi, [esp + 0x1098]
lea edx, [esp + 0x1099]
sub esi, 1
js 0x40ca04
jmp 0x40c994
nop
test esi, esi
jns 0x40ca45
mov ecx, dword [esp + 0x14]
mov eax, ebp
or eax, ecx
je 0x40d762
mov edi, dword [ebx]
mov esi, edi
mov edx, dword [ebx + 4]
sub esi, ebp
mov eax, edx
sbb eax, ecx
mov dword [esp + 0x2c], eax
jne 0x40d762
jb 0x40ca37
cmp esi, 0x10015
jae 0x40d762
sub ebp, 0xffd
jmp 0x40c91a
mov edi, dword [esp + 0x14]
add ebp, eax
mov esi, dword [ebx + 0x38]
lea eax, [esp + 0x98]
push 0x16
push eax
adc edi, edx
mov ecx, esi
push edi
push ebp
push dword [ebx + 0x44]
call dword [0x44227c]
call esi
cmp eax, 0x16
jne 0x40d71a
movzx ecx, byte [esp + 0x9b]
movzx eax, byte [esp + 0x9a]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x99]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x98]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x40d759
test edi, edi
jl 0x40cc42
jg 0x40cac9
nop word [eax + eax]
cmp ebp, 0x4c
jb 0x40cc42
push 0x14
add ebp, 0xffffffec
lea eax, [esp + 0x88]
push eax
adc edi, 0xffffffff
push edi
lfence
mov esi, dword [ebx + 0x38]
mov ecx, esi
push ebp
push dword [ebx + 0x44]
call dword [0x44227c]
call esi
cmp eax, 0x14
jne 0x40cc42
movzx ecx, byte [esp + 0x87]
movzx eax, byte [esp + 0x86]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x85]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x84]
shl ecx, 8
or ecx, eax
cmp ecx, 0x7064b50
jne 0x40cc42
movzx eax, byte [esp + 0x93]
cdq
mov ecx, eax
mov esi, edx
movzx eax, byte [esp + 0x92]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x91]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x90]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x8f]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x8e]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x8d]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x8c]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
mov edx, dword [ebx]
or ecx, eax
mov eax, dword [ebx + 4]
add edx, 0xffffffc8
adc eax, 0xffffffff
cmp esi, eax
ja 0x40d759
nop
jb 0x40cbea
cmp ecx, edx
ja 0x40d759
push 0x38
lea eax, [esp + 0x50]
push eax
push esi
push ecx
lfence
mov esi, dword [ebx + 0x38]
mov ecx, esi
push dword [ebx + 0x44]
call dword [0x44227c]
call esi
cmp eax, 0x38
jne 0x40cc42
movzx ecx, byte [esp + 0x4f]
movzx eax, byte [esp + 0x4e]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x4d]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x4c]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6064b50
jne 0x40cc42
mov eax, dword [ebx + 0x48]
mov dword [eax + 0x34], 1
movzx ecx, byte [esp + 0xa3]
movzx eax, byte [esp + 0xa2]
movzx esi, byte [esp + 0x9d]
movzx edi, byte [esp + 0xa7]
shl ecx, 8
or ecx, eax
shl esi, 8
movzx eax, byte [esp + 0xa0]
mov dword [ebx + 0x10], ecx
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esp + 0xa1]
shl ecx, 8
or ecx, eax
shl edi, 8
movzx eax, byte [esp + 0x9c]
or esi, eax
mov dword [esp + 0x20], ecx
movzx ecx, byte [esp + 0x9f]
movzx eax, byte [esp + 0x9e]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x38], esi
movzx eax, byte [esp + 0xa6]
or edi, eax
mov dword [esp + 0x14], ecx
movzx eax, byte [esp + 0xa5]
shl edi, 8
or edi, eax
movzx eax, byte [esp + 0xa4]
shl edi, 8
or edi, eax
movzx eax, byte [esp + 0xab]
cdq
mov ebp, eax
mov dword [esp + 0x30], edi
movzx eax, byte [esp + 0xaa]
mov ecx, edx
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0xa9]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0xa8]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
mov dword [esp + 0x3c], ecx
mov eax, dword [ebx + 0x48]
mov dword [esp + 0x34], ebp
cmp dword [eax + 0x34], 0
je 0x40d112
movzx ecx, byte [esp + 0x97]
movzx eax, byte [esp + 0x96]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x95]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x94]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x73]
cdq
mov dword [esp + 0x18], ecx
mov ebp, eax
movzx eax, byte [esp + 0x72]
mov ecx, edx
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x71]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x70]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x6f]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x6e]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x6d]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x6c]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
mov dword [esp + 0x38], ecx
movzx eax, byte [esp + 0x6b]
cdq
mov esi, eax
mov dword [esp + 0x1c], ebp
movzx eax, byte [esp + 0x6a]
mov ecx, edx
shld ecx, esi, 8
cdq
shl esi, 8
or ecx, edx
or esi, eax
movzx eax, byte [esp + 0x69]
shld ecx, esi, 8
cdq
shl esi, 8
or ecx, edx
or esi, eax
movzx eax, byte [esp + 0x68]
shld ecx, esi, 8
cdq
shl esi, 8
or esi, eax
or ecx, edx
shld ecx, esi, 8
movzx eax, byte [esp + 0x67]
cdq
or ecx, edx
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x66]
shld ecx, esi, 8
cdq
or ecx, edx
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x65]
shld ecx, esi, 8
cdq
or ecx, edx
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x64]
shld ecx, esi, 8
cdq
or ecx, edx
shl esi, 8
or esi, eax
mov dword [esp + 0x34], ecx
movzx eax, byte [esp + 0x7b]
cdq
mov edi, eax
mov dword [esp + 0x20], esi
movzx eax, byte [esp + 0x7a]
mov ecx, edx
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x79]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x78]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x77]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x76]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x75]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x74]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
mov dword [esp + 0x24], ecx
movzx eax, byte [esp + 0x57]
cdq
mov ecx, edx
mov dword [esp + 0x30], edi
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x56]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x55]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x54]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x53]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x52]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x51]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x50]
cdq
or dword [esp + 0x10], eax
or ecx, edx
ja 0x40cfd6
cmp dword [esp + 0x10], 0x2c
jb 0x40d73e
cmp dword ds:[esp + 0x18], 1
jne 0x40d750
cmp dword [esp + 0x38], 0
ja 0x40d432
jb 0x40cffc
cmp ebp, 0xffffffff
ja 0x40d432
cmp dword [esp + 0x34], 0
mov dword [ebx + 0x10], ebp
ja 0x40d432
jb 0x40d015
cmp esi, 0xffffffff
ja 0x40d432
cmp dword ds:[esp + 0x24], 0
ja 0x40d426
cmp edi, 0xffffffff
ja 0x40d426
movzx esi, byte [esp + 0x5f]
movzx eax, byte [esp + 0x5e]
movzx ecx, byte [esp + 0x63]
shl ecx, 8
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x5d]
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x5c]
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x62]
or ecx, eax
mov dword [esp + 0x38], esi
movzx eax, byte [esp + 0x61]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x60]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x83]
cdq
mov dword [esp + 0x14], ecx
mov ebp, eax
movzx eax, byte [esp + 0x82]
mov ecx, edx
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x81]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x80]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x7f]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x7e]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x7d]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x7c]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ebp, eax
or ecx, edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ecx
mov eax, dword ds:[esp + 0x20]
cmp dword [esp + 0x1c], eax
jne 0x40d750
mov edx, dword [esp + 0x14]
mov eax, edx
or eax, esi
je 0x40d148
cmp esi, 1
jne 0x40d750
nop dword [eax]
cmp edx, esi
jne 0x40d750
mov esi, dword ds:[esp + 0x1c]
mov edx, 0x2e
mov eax, esi
mul edx
mov dword [esp + 0x18], eax
xor eax, eax
cmp eax, edx
jb 0x40d73e
ja 0x40d174
cmp edi, dword [esp + 0x18]
jb 0x40d73e
mov edx, edi
add edx, ebp
adc eax, ecx
cmp eax, dword [ebx + 4]
ja 0x40d73e
jb 0x40d193
cmp edx, dword [ebx]
ja 0x40d73e
mov dword ds:[ebx + 8], ebp
mov dword [ebx + 0xc], ecx
test esi, esi
je 0x40d6f1
mov eax, dword [ebx + 0x48]
mov dword [esp + 0x18], eax
cmp edi, dword [eax + 8]
jbe 0x40d1e0
lfence
mov esi, dword [ebx + 0x30]
mov ecx, esi
push edi
push dword [eax + 0xc]
push dword [eax]
push dword [ebx + 0x34]
call dword [0x44227c]
call esi
mov ecx, eax
test ecx, ecx
je 0x40d723
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov eax, dword [ebx + 0x48]
mov ecx, dword [ebx + 0x10]
add eax, 0x10
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
cmp ecx, dword [eax + 8]
jbe 0x40d229
push ecx
lfence
push dword [eax + 0xc]
mov esi, dword [ebx + 0x30]
mov ecx, esi
push dword [eax]
push dword [ebx + 0x34]
call dword [0x44227c]
call esi
mov ecx, eax
test ecx, ecx
je 0x40d723
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov dword ds:[eax + 4], ecx
mov eax, dword [ebx + 0x48]
mov ecx, dword [ebx + 0x10]
add eax, 0x20
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
cmp ecx, dword [eax + 8]
jbe 0x40d275
push ecx
lfence
push dword [eax + 0xc]
mov esi, dword [ebx + 0x30]
mov ecx, esi
push dword [eax]
push dword [ebx + 0x34]
call dword [0x44227c]
call esi
mov ecx, eax
test ecx, ecx
je 0x40d723
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
lfence
mov eax, dword [ebx + 0x48]
mov esi, dword [ebx + 0x38]
mov ecx, esi
push edi
push dword [eax]
push dword [esp + 0x44]
push ebp
push dword [ebx + 0x44]
call dword [0x44227c]
call esi
cmp eax, edi
jne 0x40d71a
mov esi, dword [ebx + 0x48]
xor edx, edx
mov dword [esp + 0x18], edx
mov esi, dword [esi]
cmp dword [ebx + 0x10], edx
jbe 0x40d6f1
cmp edi, 0x2e
jb 0x40d73e
movzx ecx, byte ds:[esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x2014b50
jne 0x40d73e
mov eax, dword ds:[ebx + 0x48]
mov ecx, esi
sub ecx, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [eax + edx*4], ecx
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + 0x20]
mov dword [eax + edx*4], edx
movzx eax, byte [esi + 0x17]
cdq
mov ecx, eax
mov ebp, edx
movzx eax, byte [esi + 0x16]
shld ebp, ecx, 8
cdq
or ebp, edx
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x15]
shld ebp, ecx, 8
cdq
or ebp, edx
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x14]
cdq
shld ebp, ecx, 8
or ebp, edx
shl ecx, 8
or ecx, eax
mov dword [esp + 0x1c], ebp
movzx eax, byte [esi + 0x1b]
cdq
mov edi, eax
mov dword [esp + 0x14], ecx
movzx eax, byte [esi + 0x1a]
mov ebp, edx
shld ebp, edi, 8
cdq
or ebp, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 0x19]
shld ebp, edi, 8
cdq
or ebp, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 0x18]
shld ebp, edi, 8
cdq
or ebp, edx
shl edi, 8
or edi, eax
mov dword [esp + 0x20], ebp
movzx eax, byte [esi + 0x2d]
cdq
mov ebp, eax
mov dword [esp + 0x28], edi
movzx eax, byte [esi + 0x2c]
shld edx, ebp, 8
shl ebp, 8
mov dword [esp + 0x10], edx
cdq
or ebp, eax
mov eax, dword [esp + 0x10]
or eax, edx
shld eax, ebp, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esi + 0x2b]
cdq
shl ebp, 8
or ebp, eax
mov eax, dword [esp + 0x10]
or eax, edx
shld eax, ebp, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esi + 0x2a]
shl ebp, 8
cdq
or ebp, eax
or dword [esp + 0x10], edx
movzx edx, byte [esi + 0x1d]
movzx eax, byte [esi + 0x1c]
mov dword [esp + 0x24], ebp
movzx ebp, byte [esi + 0x1f]
shl edx, 8
or edx, eax
shl ebp, 8
movzx eax, byte [esi + 0x1e]
or ebp, eax
mov dword [esp + 0x48], edx
mov eax, dword [ebx + 0x48]
mov edx, dword [esp + 0x1c]
cmp dword [eax + 0x38], 0
jne 0x40d59d
test ebp, ebp
je 0x40d59d
mov eax, dword [esp + 0x20]
cmp edx, eax
jb 0x40d43e
ja 0x40d41c
cmp ecx, edi
jbe 0x40d43e
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], edx
jmp 0x40d446
mov dword [ebx + 0x1c], 0xf
jmp 0x40d769
mov dword [ebx + 0x1c], 2
jmp 0x40d769
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x40]
cmp ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jb 0x40d492
ja 0x40d46a
mov eax, dword ds:[esp + 0x24]
cmp dword [esp + 0x44], eax
jbe 0x40d496
mov eax, dword [esp + 0x20]
cmp edx, eax
jb 0x40d482
ja 0x40d474
cmp ecx, edi
jbe 0x40d482
mov eax, ecx
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x14]
jmp 0x40d496
mov ecx, dword [esp + 0x20]
mov eax, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x14]
jmp 0x40d496
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
jne 0x40d59d
cmp dword [esp + 0x10], 0
jne 0x40d59d
mov edi, dword ds:[esp + 0x48]
mov dword [esp + 0x10], 0
lea eax, [edi + 0x2e]
add eax, ebp
cmp eax, dword [esp + 0x30]
jbe 0x40d51d
push ebp
push 0
lfence
push dword [0x46fcc0]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword ds:[esp + 0x10], eax
test eax, eax
je 0x40d723
xor ecx, ecx
add edi, dword [esp + 0x34]
push ebp
adc ecx, dword [esp + 0x40]
add edi, 0x2e
push eax
adc ecx, 0
push ecx
push edi
lfence
mov edi, dword [ebx + 0x38]
mov ecx, edi
push dword [ebx + 0x44]
call dword [0x44227c]
call edi
cmp eax, ebp
jne 0x40d705
mov edi, dword [esp + 0x10]
jmp 0x40d522
add edi, 0x2e
add edi, esi
cmp ebp, 4
jb 0x40d72c
movzx edx, byte ds:[edi + 3]
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
lea eax, [edx + 4]
cmp eax, ebp
ja 0x40d72c
movzx ecx, byte [edi + 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 1
je 0x40d56b
add edi, 4
mov eax, 0xfffffffc
sub eax, edx
add edi, edx
add ebp, eax
jne 0x40d522
jmp 0x40d57f
mov eax, dword [ebx + 0x48]
mov dword [eax + 0x34], 1
mov eax, dword [ebx + 0x48]
mov dword [eax + 0x38], 1
push dword [esp + 0x10]
push 0
push dword [0x46fcc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
nop dword [eax]
cmp ecx, 0xffffffff
jne 0x40d5a9
test edx, edx
je 0x40d5fe
mov ebp, dword [esp + 0x20]
cmp edi, 0xffffffff
jne 0x40d5b6
test ebp, ebp
je 0x40d5fe
movzx ecx, byte [esi + 0xd]
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
mov ecx, dword [esp + 0x14]
jne 0x40d5f0
nop dword [eax + eax]
cmp edi, ecx
jne 0x40d73e
cmp ebp, edx
jne 0x40d73e
or edi, ebp
je 0x40d5fe
mov eax, ecx
or eax, edx
je 0x40d73e
movzx edi, byte [esi + 0x23]
movzx eax, byte [esi + 0x22]
shl edi, 8
or edi, eax
cmp edi, 0xffff
je 0x40d750
cmp edi, dword [esp + 0x38]
je 0x40d629
nop dword [eax]
cmp edi, 1
jne 0x40d750
cmp ecx, 0xffffffff
jne 0x40d636
test edx, edx
je 0x40d693
movzx eax, byte ds:[esi + 0x2d]
cdq
mov edi, eax
mov ecx, edx
movzx eax, byte [esi + 0x2c]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esi + 0x2b]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esi + 0x2a]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
add edi, dword [esp + 0x14]
adc ecx, dword [esp + 0x1c]
add edi, 0x1e
adc ecx, 0
cmp ecx, dword [ebx + 4]
ja 0x40d73e
jb 0x40d693
cmp edi, dword [ebx]
ja 0x40d73e
test byte [esi + 9], 0x20
jne 0x40d747
movzx edx, byte [esi + 0x21]
movzx eax, byte [esi + 0x20]
movzx ecx, byte [esi + 0x1f]
mov edi, dword [esp + 0x30]
shl edx, 8
or edx, eax
shl ecx, 8
movzx eax, byte [esi + 0x1e]
or ecx, eax
movzx eax, byte [esi + 0x1c]
add edx, ecx
movzx ecx, byte [esi + 0x1d]
shl ecx, 8
or eax, ecx
add eax, 0x2e
add eax, edx
cmp eax, edi
ja 0x40d73e
mov edx, dword [esp + 0x18]
sub edi, eax
inc edx
mov dword [esp + 0x30], edi
add esi, eax
mov dword [esp + 0x18], edx
cmp edx, dword [ebx + 0x10]
jb 0x40d2b2
mov ecx, ebx
call fcn.0040c3c0
mov eax, 1
jmp 0x40d76b
push dword [esp + 0x10]
lfence
push 0
push dword [0x46fcc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebx + 0x1c], 0x14
jmp 0x40d769
mov dword [ebx + 0x1c], 0x10
jmp 0x40d769
push dword [esp + 0x10]
push 0
push dword [0x46fcc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebx + 0x1c], 9
jmp 0x40d769
mov dword [ebx + 0x1c], 5
jmp 0x40d769
mov dword [ebx + 0x1c], 0xa
jmp 0x40d769
mov dword [ebx + 0x1c], 8
jmp 0x40d769
mov dword [ebx + 0x1c], 7
xor eax, eax
mov ecx, dword [esp + 0x209c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004218f3
add esp, 0x2094
ret