Function at 0x43c270
Capabilities:
Contain obfuscated stackstrings
Get user security identifier
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x4e8517
mov eax, dword fs:[0]
push eax
mov eax, 0x17f4
call fcn.004c3aa0
mov eax, dword [0x670f1c]
xor eax, esp
mov dword [esp + 0x17f0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x670f1c]
xor eax, esp
push eax
lea eax, [esp + 0x1808]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1818]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x181c]
xor ebx, ebx
push ebx
mov esi, ecx
push eax
mov dword [esp + 0x254], esi
call fcn.00454610
lea edi, [esi + 0x1916a]
mov ecx, edi
mov dword [esp + 0x1810], ebx
call fcn.0046ffb0
mov ecx, dword [esp + 0x14]
lea ebp, [esi + 0x192ac]
push ecx
mov ecx, ebp
mov byte [esp + 0x1814], 1
call fcn.00418770
mov dword [esi], vtable.CCluDownloadSocket.4.0
mov dword [esi + 0x1908c], 0x4fcf34
mov dword [esi + 0x190fc], 0x4fceb4
mov dword [edi], vtable.CCluDownloadSocket.1.0
mov dword [ebp], vtable.CCluDownloadSocket.0
mov dword [esi + 0x194b0], 0xf
mov dword [esi + 0x194ac], ebx
mov byte [esi + 0x1949c], bl
mov dword [esi + 0x194cc], 7
mov dword [esi + 0x194c8], ebx
mov word [esi + 0x194b8], bx
lea edi, [esi + 0x194d4]
mov ecx, edi
mov byte [esp + 0x1810], 4
call fcn.00440e40
mov dword [edi + 4], eax
mov byte [eax + 0xbd], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea ebp, [esi + 0x194e0]
mov ecx, ebp
mov byte [esp + 0x1810], 5
call fcn.0045bfc0
mov dword [ebp + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
mov byte [esp + 0x1810], 6
call fcn.004b978a
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43c3da
push 0x80004005
call fcn.004069a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x194ec], eax
lea ebp, [esi + 0x19520]
mov ecx, ebp
mov byte [esp + 0x1810], 7
mov byte [esi + 0x194f4], 1
mov byte [esi + 0x194f5], bl
mov word [esi + 0x1950a], bx
mov dword [esi + 0x1950c], ebx
mov dword [esi + 0x19510], ebx
mov dword [esi + 0x19514], ebx
mov dword [esi + 0x19518], ebx
call fcn.00440e80
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x19542]
mov ecx, ebp
mov byte [esp + 0x1810], 8
mov dword [esi + 0x1952c], ebx
mov byte [esi + 0x19530], bl
call fcn.0045bfc0
mov dword [ebp + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x1954e]
mov ecx, ebp
mov byte [esp + 0x1810], 9
call fcn.0045bfc0
mov dword [ebp + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
movzx ecx, word [esi + 0x196c4]
push ebx
push ecx
push esi
lea ecx, [esi + 0x1955a]
mov byte [esp + 0x181c], 0xa
call fcn.004468f0
lea ebp, [esi + 0x195de]
mov ecx, ebp
mov byte [esp + 0x1810], 0xb
call fcn.00440e00
mov dword [ebp + 4], eax
mov byte [eax + 0x35], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
mov byte [esp + 0x1810], 0xc
lea ecx, [esi + 0x195ea]
call fcn.00446650
mov dword [esi + 0x19616], ebx
mov dword [esi + 0x1961a], ebx
mov dword [esi + 0x1961e], ebx
mov dword [esi + 0x19622], ebx
mov dword [esi + 0x19626], ebx
mov dword [esi + 0x1962a], ebx
mov dword [esi + 0x1962e], ebx
mov dword [esi + 0x19632], ebx
mov dword [esi + 0x1963e], ebx
mov dword [esi + 0x19642], ebx
mov dword [esi + 0x19646], ebx
mov dword [esi + 0x1964a], ebx
mov dword [esi + 0x19666], 7
mov dword [esi + 0x19662], ebx
mov word [esi + 0x19652], bx
mov dword [esi + 0x1966e], ebx
mov dword [esi + 0x19672], ebx
mov dword [esi + 0x19676], ebx
mov dword [esi + 0x1967a], ebx
mov dword [esi + 0x1967e], ebx
mov dword [esi + 0x19686], ebx
mov dword [esi + 0x196a2], 0xf
mov dword [esi + 0x1969e], ebx
mov byte [esi + 0x1968e], bl
lea ecx, [esi + 0x196b6]
mov byte [esp + 0x1810], 0x10
mov byte [esi + 0x196a6], bl
call fcn.00446ed0
fldz
fstp qword [esi + 0x19d08]
mov dword [esi + 0x19cf6], ebx
mov byte [esi + 0x19d06], bl
mov dword [esi + 0x19d10], ebx
mov dword [esi + 0x19d14], ebx
mov dword [esi + 0x19d18], ebx
mov dword [esi + 0x19d20], ebx
mov dword [esi + 0x19d24], ebx
mov dword [esi + 0x19d28], ebx
mov dword [esi + 0x19d2c], ebx
lea ebp, [esi + 0x19d30]
mov ecx, ebp
mov byte [esp + 0x1810], 0x12
call fcn.00440dc0
mov dword [ebp + 4], eax
mov byte [eax + 0x1d], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x19d3c]
mov ecx, ebp
mov byte [esp + 0x1810], 0x13
call fcn.00440dc0
mov dword [ebp + 4], eax
mov byte [eax + 0x1d], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
mov byte [esp + 0x1810], 0x14
mov dword [esi + 0x19d48], ebx
mov dword [esi + 0x19d4c], ebx
mov dword [esi + 0x19d50], ebx
mov dword [esi + 0x19d54], ebx
mov dword [esi + 0x19d58], ebx
lea ecx, [esi + 0x19d66]
mov dword [esi + 0x19d5c], ebx
mov byte [esi + 0x19d60], bl
mov dword [esi + 0x19d62], ebx
call fcn.0048ec20
lea ebp, [esi + 0x19e6e]
mov ecx, ebp
mov byte [esp + 0x1810], 0x15
call fcn.00440e80
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
mov dword [esi + 0x19e7a], ebx
mov dword [esi + 0x19e7e], ebx
mov dword [esi + 0x19e82], ebx
mov dword [esi + 0x19e86], ebx
mov word [esi + 0x19e8a], bx
mov word [esi + 0x19e8c], bx
mov word [esi + 0x19e8e], bx
mov byte [esi + 0x19e90], bl
mov byte [esi + 0x19e91], bl
mov byte [esi + 0x19e92], bl
mov word [esi + 0x19e94], bx
mov dword [esi + 0x19e96], ebx
mov eax, 1
lea ebp, [esi + 0x19ec8]
mov ecx, ebp
mov byte [esp + 0x1810], 0x16
mov byte [esi + 0x19e9a], bl
mov word [esi + 0x19e9c], ax
mov word [esi + 0x19e9e], bx
mov dword [esi + 0x19ea0], eax
mov word [esi + 0x19ea4], bx
mov dword [esi + 0x19ea6], ebx
mov dword [esi + 0x19eaa], ebx
mov dword [esi + 0x19eae], ebx
mov dword [esi + 0x19eb2], ebx
mov dword [esi + 0x19eb6], ebx
mov dword [esi + 0x19eba], ebx
mov dword [esi + 0x19ebe], ebx
mov dword [esi + 0x19ec2], ebx
mov byte [esi + 0x19ec6], bl
call fcn.00440e80
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x19ed4]
mov ecx, ebp
mov byte [esp + 0x1810], 0x17
call fcn.00440e80
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x19ee0]
mov ecx, ebp
mov byte [esp + 0x1810], 0x18
call fcn.00440e80
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
push ebx
mov byte [esp + 0x1814], 0x19
mov byte [esi + 0x19eec], bl
call fcn.00419310
mov edx, dword [eax + 0x58]
push edx
lea ecx, [esi + 0x19eee]
call fcn.0048ef20
push ebx
mov byte [esp + 0x1814], 0x1a
call fcn.00419310
mov eax, dword [eax + 0x60]
push eax
lea ecx, [esi + 0x19f2a]
call fcn.0048ef20
lea ecx, [esi + 0x19f76]
push 0x80000001
mov byte [esp + 0x1814], 0x1b
mov dword [esi + 0x19f66], ebx
mov dword [esi + 0x19f6a], ebx
mov dword [esi + 0x19f6e], ebx
mov dword [esi + 0x19f72], ebx
call fcn.00454730
lea ebp, [esi + 0x19f9c]
mov ecx, ebp
mov byte [esp + 0x1810], 0x1c
mov dword [esi + 0x19f7e], ebx
mov dword [esi + 0x19f82], ebx
mov dword [esi + 0x19f86], ebx
mov byte [esi + 0x19f8e], bl
mov byte [esi + 0x19f8f], bl
mov dword [esi + 0x19f90], ebx
mov dword [esi + 0x19f94], ebx
mov dword [esi + 0x19f98], ebx
call fcn.0045c040
mov dword [ebp + 4], eax
mov byte [eax + 0x21], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x19fae]
mov ecx, ebp
mov byte [esp + 0x1810], 0x1d
mov byte [esi + 0x19fa8], bl
mov word [esi + 0x19faa], bx
mov byte [esi + 0x19fac], bl
call fcn.0048ee20
mov dword [ebp + 4], eax
mov byte [eax + 0x19], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea ebp, [esi + 0x19fba]
mov ecx, ebp
mov byte [esp + 0x1810], 0x1e
call fcn.00440e80
mov dword [ebp + 4], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp + 4]
mov dword [eax + 4], eax
mov eax, dword [ebp + 4]
mov dword [eax], eax
mov eax, dword [ebp + 4]
mov dword [eax + 8], eax
mov dword [ebp + 8], ebx
lea eax, [esi + 0x192ac]
push eax
lea ecx, [esi + 0x19fe2]
mov byte [esp + 0x1814], 0x1f
mov dword [esi + 0x19fc6], ebx
mov dword [esi + 0x19fca], ebx
mov dword [esi + 0x19fce], ebx
mov dword [esi + 0x19fd2], ebx
mov dword [esi + 0x19fd6], ebx
mov dword [esi + 0x19fda], ebx
call fcn.004435e0
fld qword [0x4f67b0]
fstp qword [esi + 0x1a358]
lea ecx, [esi + 0x1960e]
fld qword [0x4fb8c8]
push ecx
fst qword [esi + 0x1a368]
mov ecx, esi
fstp qword [esi + 0x1a370]
mov byte [esp + 0x1814], 0x20
mov dword [esi + 0x1a2c0], ebx
mov dword [esi + 0x1a2c4], ebx
mov dword [esi + 0x1a2c8], ebx
mov dword [esi + 0x1a2cc], ebx
mov dword [esi + 0x1a2e0], ebx
mov dword [esi + 0x1a2e4], ebx
mov dword [esi + 0x1a2e8], ebx
mov dword [esi + 0x1a2ec], ebx
mov dword [esi + 0x1a2f0], ebx
mov dword [esi + 0x1a2f4], ebx
mov dword [esi + 0x1a2f8], ebx
mov dword [esi + 0x1a2fc], ebx
mov dword [esi + 0x1a300], ebx
mov dword [esi + 0x1a304], ebx
mov dword [esi + 0x1a308], ebx
mov dword [esi + 0x1a30c], ebx
mov dword [esi + 0x1a310], ebx
mov dword [esi + 0x1a314], ebx
mov dword [esi + 0x1a318], ebx
mov dword [esi + 0x1a31c], ebx
mov byte [esi + 0x1a320], bl
mov dword [esi + 0x1a322], ebx
mov dword [esi + 0x1a326], ebx
mov dword [esi + 0x1a32a], ebx
mov dword [esi + 0x1a32e], ebx
mov word [esi + 0x1a332], bx
mov dword [esi + 0x1a334], ebx
mov dword [esi + 0x1a338], ebx
mov dword [esi + 0x1a33c], ebx
mov dword [esi + 0x1a340], ebx
mov dword [esi + 0x1a344], ebx
mov dword [esi + 0x1a348], ebx
mov dword [esi + 0x1a34c], ebx
mov dword [esi + 0x1a350], ebx
mov dword [esi + 0x1a354], ebx
mov dword [esi + 0x1a360], ebx
mov dword [esi + 0x1a364], ebx
mov byte [esi + 0x1a378], bl
call fcn.004723d0
mov dword [esi + 0x192b8], 2
mov dword [esi + 0x19532], ebx
mov dword [esi + 0x19536], ebx
mov dword [esi + 0x1953e], ebx
mov byte [esi + 0x1951d], bl
mov byte [esi + 0x1951c], bl
mov edx, dword [0x66e854]
push edx
call fcn.004aef3e
push 0x100000
mov dword [esi + 0x19606], eax
call fcn.004aef3e
mov dword [esi + 0x1960a], eax
mov dword [esi + 0x194f6], ebx
mov dword [esi + 0x194fa], ebx
call fcn.00419310
movzx eax, word [eax + 0x80]
mov word [esi + 0x196a8], ax
call fcn.00419310
movzx ecx, word [eax + 0x80]
mov word [esi + 0x196aa], cx
mov word [esi + 0x196ac], bx
mov dword [esi + 0x196ae], ebx
mov dword [esi + 0x196b2], ebx
call fcn.00419310
mov eax, dword [eax + 0x14]
cdq
mov dword [esi + 0x1925c], eax
mov dword [esi + 0x19260], edx
call fcn.00419310
mov eax, dword [eax + 0x14]
cdq
mov dword [esi + 0x19264], eax
mov dword [esi + 0x19268], edx
mov dword [esi + 0x1926c], 1
mov byte [esi + 0x19502], 4
mov dword [esi + 0x19504], ebx
mov byte [esi + 0x19508], bl
call fcn.00419310
mov dx, word [eax + 4]
mov word [esi + 0x194fe], dx
call fcn.00419310
movzx eax, word [eax + 4]
mov word [esi + 0x19500], ax
mov byte [esi + 0x1951e], bl
push ebx
mov dword [esi + 0x1a382], ebx
call fcn.004c0de9
add esp, 0xc
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
call fcn.004c1665
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fnstcw word [esp + 0x20]
movzx eax, word [esp + 0x20]
fdiv qword [0x4f9548]
or eax, 0xc00
mov dword [esp + 0x14], eax
push 0x4fb910
fmul qword [0x4fcfa8]
fild qword [esp + 0x2c]
faddp st(1)
fsub qword [0x4fcfa0]
fldcw word [esp + 0x18]
fistp qword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x19682], ecx
fldcw word [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x19cfa], eax
je 0x43cc48
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4fb92c
push eax
call ebp
mov dword [esi + 0x19cfe], eax
mov edx, dword [esi + 0x19cfa]
push 0x4fb940
push edx
call ebp
mov dword [esi + 0x19d02], eax
jmp 0x43cc54
mov dword [esi + 0x19cfe], ebx
mov dword [esi + 0x19d02], ebx
push 0x640
lea eax, [esi + 0x196b6]
push ebx
push eax
call fcn.004c16f0
mov byte [esi + 0x19e90], 1
mov byte [esi + 0x19e91], 1
mov byte [esi + 0x19e92], 0xa
mov word [esi + 0x19e94], 0x35f
mov dword [esi + 0x19e96], 0x1000001
movzx eax, word [esi + 0x19e96]
movzx ecx, byte [esi + 0x19e98]
movzx edx, byte [esi + 0x19e99]
push eax
movzx eax, word [esi + 0x19e94]
push ecx
movzx ecx, byte [esi + 0x19e92]
push edx
movzx edx, byte [esi + 0x19e91]
push eax
movzx eax, byte [esi + 0x19e90]
push ecx
push edx
push eax
push 0x4fb950
lea ebp, [esi + 0x192ac]
push ebp
call fcn.00418ea0
add esp, 0x30
push 0x6733cc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cx, word [0x6733c0]
push 0x6733cc
mov word [esp + 0x24], cx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, word [esp + 0x20]
add eax, 0xffffffff
cmp eax, 3
ja case.default.0x43cd09
jmp dword [eax*4 + 0x43f7a8]
push 0x4fba00
jmp 0x43cd2a
push 0x4fb9c4
jmp 0x43cd2a
push 0x4fba48
jmp 0x43cd2a
push 0x4fba90
push ebp
call fcn.00418ea0
add esp, 8
lea ecx, [esp + 0x25c]
call fcn.00494200
lea ecx, [esp + 0x25c]
mov byte [esp + 0x1810], 0x21
call fcn.00494d70
call fcn.004b978a
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43cd6d
push 0x80004005
call fcn.004069a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x294]
mov edx, dword [esp + 0x264]
mov eax, dword [esp + 0x280]
push ecx
mov ecx, dword [esp + 0x278]
push edx
push eax
push ecx
lea edx, [esp + 0x34]
push 0x4fbad4
push edx
mov byte [esp + 0x1828], 0x22
call fcn.00406da0
add esp, 0x18
call fcn.004b978a
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43cdd1
push 0x80004005
call fcn.004069a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x25c]
mov byte [esp + 0x1810], 0x23
call fcn.00493660
test al, al
push 5
lea ecx, [esp + 0x2c]
je 0x43ce06
push 0x4fbaf8
jmp 0x43ce0b
push 0x4fbb04
call fcn.00406c90
call fcn.004b978a
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43ce2a
push 0x80004005
call fcn.004069a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x3fc]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x3f8]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push 0x4fbb10
push ecx
mov byte [esp + 0x1824], 0x24
call fcn.00406da0
push 0x4fbb24
push ebp
call fcn.00418e60
mov eax, dword [esp + 0x3c]
add esp, 0x1c
cmp dword [eax - 4], 1
jle 0x43ce8f
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 0x24]
call fcn.00406b50
mov eax, dword [esp + 0x20]
push eax
push 0x4fbb40
push ebp
call fcn.00418e60
mov eax, dword [esp + 0x30]
add esp, 0xc
cmp dword [eax - 4], 1
jle 0x43ceb9
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x28]
call fcn.00406b50
mov eax, dword [esp + 0x24]
push eax
push 0x4fbb54
push ebp
call fcn.00418e60
mov ecx, dword [esp + 0x2b8]
push ecx
push 0x4fbb68
push ebp
call fcn.00418e60
mov edx, dword [esp + 0x2c8]
push edx
push 0x4fbb90
push ebp
call fcn.00418e60
add esp, 0x24
lea eax, [esi + 0x19686]
push eax
push 0x4fbbb4
push 0x4fbbc8
lea ecx, [esi + 0x19f76]
call fcn.00455440
push 0x40
call fcn.004aef0e
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, ebx
mov byte [esp + 0x1810], 0x25
je 0x43cf2d
mov ecx, eax
call fcn.004a7f50
jmp 0x43cf2f
xor eax, eax
mov dword [esi + 0x19f8a], eax
lea eax, [esi + 0x19f6e]
push eax
mov ecx, esi
mov byte [esp + 0x1814], 0x24
call fcn.004723d0
mov eax, dword [0x66e854]
push ebx
mov dword [esi + 0x19fde], eax
push 0x4f678c
lea ecx, [esi + 0x19498]
mov dword [esi + 0x194d0], ebx
call fcn.004017d0
push ebx
push 0x51a3d8
lea ecx, [esi + 0x194b4]
call fcn.00401930
lea ecx, [esp + 0x248]
push ecx
lea edx, [esp + 0x194]
push edx
lea eax, [esp + 0x100c]
push eax
lea ecx, [esp + 0x1a0]
push ecx
lea edx, [esp + 0x414]
push edx
mov dword [esi + 0x1a2d0], ebx
push 0x4fbbf8
mov dword [esi + 0x1a2d8], ebx
push ebx
mov dword [esi + 0x1a2dc], ebx
mov dword [esp + 0x1b0], 0x400
mov dword [esp + 0x1ac], 0x800
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
cmp eax, ebx
je 0x43d079
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x408]
push ecx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp eax, ebx
je 0x43d06b
mov edx, dword [esp + 0x14]
push edx
push 0x4fbc0c
lea eax, [esp + 0x80c]
push 0x400
push eax
call fcn.004c678a
mov ecx, dword [esp + 0x24]
add esp, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
lea eax, [esi + 0x1a2d8]
push eax
push 1
lea edx, [esp + 0x810]
push edx
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
cmp eax, ebx
je 0x43d05d
push 0x4fbc48
mov dword [esi + 0x1a2d4], 0xc
push ebp
mov dword [esi + 0x1a2dc], ebx
call fcn.00418e60
add esp, 8
jmp 0x43d08e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4fbca8
jmp 0x43d085
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4fbd38
jmp 0x43d085
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4fbd88
push ebp
call fcn.00418e60
add esp, 0xc
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
or ecx, 0xffffffff
sub esp, 0x10
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push ebx
push ebx
push ebx
xor ecx, ecx
push ebx
mov dword [eax], ecx
push ebx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
push 1
sub esp, 0x1c
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 3
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
push 0x4fbdd0
mov word [ecx + 4], bx
call fcn.00401930
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x26
mov byte [esp + 0x34], bl
call fcn.00441690
mov al, byte [esp + 0x30]
lea ecx, [esp + 0x32]
push ecx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x27
mov byte [esp + 0xe4], al
call fcn.00441690
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x1818], 0x28
call fcn.0042ddb0
mov ebp, 8
cmp dword [esp + 0xfa], ebp
jb 0x43d1e5
mov ecx, dword [esp + 0xe6]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43d212
mov edx, dword [esp + 0x36]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43d244
mov eax, dword [esp + 0x19e]
push eax
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x494e80
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push ebx
push ebx
push ebx
push ebx
mov ecx, 0x494eb0
mov dword [eax], ecx
xor ecx, ecx
push ebx
mov dword [eax + 4], ecx
push ebx
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbdd8
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
mov byte [esp + 0x1810], 0x29
mov byte [esp + 0x30], 3
push eax
lea ecx, [esp + 0x36]
call fcn.00441690
mov cl, byte [esp + 0x30]
lea edx, [esp + 0x32]
mov byte [esp + 0xe0], cl
push edx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x2a
call fcn.00441690
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x1818], 0x2b
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43d386
mov edx, dword [esp + 0xe6]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43d3b3
mov eax, dword [esp + 0x36]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43d3e5
mov ecx, dword [esp + 0x19e]
push ecx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a6da0
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a72e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a73e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push 5
push 0x1e
push 2
push 0x2401
mov ecx, 0x4a6de0
mov dword [eax], ecx
xor ecx, ecx
push 0x2400
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbde0
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x2c
mov byte [esp + 0x34], 0x36
call fcn.00441690
mov dl, byte [esp + 0x30]
lea eax, [esp + 0x32]
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x2d
mov byte [esp + 0xe4], dl
call fcn.00441690
lea ecx, [esp + 0xe0]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esp + 0x1818], 0x2e
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43d535
mov eax, dword [esp + 0xe6]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43d562
mov ecx, dword [esp + 0x36]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43d594
mov edx, dword [esp + 0x19e]
push edx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a5520
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a57e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a5540
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a58e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push 0x2201
mov ecx, 0x4a5610
mov dword [eax], ecx
xor ecx, ecx
push 0x2200
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbdf0
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x2f
mov byte [esp + 0x34], 0x48
call fcn.00441690
mov al, byte [esp + 0x30]
lea ecx, [esp + 0x32]
push ecx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x30
mov byte [esp + 0xe4], al
call fcn.00441690
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x1818], 0x31
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43d6e6
mov ecx, dword [esp + 0xe6]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43d713
mov edx, dword [esp + 0x36]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43d745
mov eax, dword [esp + 0x19e]
push eax
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a5520
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a57e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a5540
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a58e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push 0x2201
mov ecx, 0x4a5610
mov dword [eax], ecx
xor ecx, ecx
push 0x2200
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe00
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x32
mov byte [esp + 0x34], 0x35
call fcn.00441690
mov cl, byte [esp + 0x30]
lea edx, [esp + 0x32]
mov byte [esp + 0xe0], cl
push edx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x33
call fcn.00441690
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x1818], 0x34
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43d897
mov edx, dword [esp + 0xe6]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43d8c4
mov eax, dword [esp + 0x36]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43d8f6
mov ecx, dword [esp + 0x19e]
push ecx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a5520
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a57e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a5540
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a58e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push 0x2201
mov ecx, 0x4a5610
mov dword [eax], ecx
xor ecx, ecx
push 0x2200
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe10
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x35
mov byte [esp + 0x34], 0x4c
call fcn.00441690
mov dl, byte [esp + 0x30]
lea eax, [esp + 0x32]
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x36
mov byte [esp + 0xe4], dl
call fcn.00441690
lea ecx, [esp + 0xe0]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esp + 0x1818], 0x37
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43da48
mov eax, dword [esp + 0xe6]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43da75
mov ecx, dword [esp + 0x36]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43daa7
mov edx, dword [esp + 0x19e]
push edx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a5520
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a57e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a5540
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a58e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push 0x2201
mov ecx, 0x4a5610
mov dword [eax], ecx
xor ecx, ecx
push 0x2200
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe20
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x38
mov byte [esp + 0x34], 0x4d
call fcn.00441690
mov al, byte [esp + 0x30]
lea ecx, [esp + 0x32]
push ecx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x39
mov byte [esp + 0xe4], al
call fcn.00441690
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x1818], 0x3a
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43dbf9
mov ecx, dword [esp + 0xe6]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43dc26
mov edx, dword [esp + 0x36]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43dc58
mov eax, dword [esp + 0x19e]
push eax
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a4ce0
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a4d00
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a4d10
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a4dd0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
xor ecx, ecx
push 0x2201
mov dword [eax], ecx
mov dword [eax + 4], ecx
push 0x2200
mov dword [eax + 8], ecx
push 1
or ecx, 0xffffffff
sub esp, 0x1c
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe30
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x3b
mov byte [esp + 0x34], 0x3e
call fcn.00441690
mov cl, byte [esp + 0x30]
lea edx, [esp + 0x32]
mov byte [esp + 0xe0], cl
push edx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x3c
call fcn.00441690
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x1818], 0x3d
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43dda8
mov edx, dword [esp + 0xe6]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43ddd5
mov eax, dword [esp + 0x36]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43de07
mov ecx, dword [esp + 0x19e]
push ecx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a4040
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a4070
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a4090
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a4370
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push 0x2201
mov ecx, 0x4a4060
mov dword [eax], ecx
xor ecx, ecx
push 0x2200
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbc9c
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x3e
mov byte [esp + 0x34], 0x67
call fcn.00441690
mov dl, byte [esp + 0x30]
lea eax, [esp + 0x32]
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x3f
mov byte [esp + 0xe4], dl
call fcn.00441690
lea ecx, [esp + 0xe0]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esp + 0x1818], 0x40
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43df59
mov eax, dword [esp + 0xe6]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43df86
mov ecx, dword [esp + 0x36]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43dfb8
mov edx, dword [esp + 0x19e]
push edx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a3f70
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
xor ecx, ecx
push 0x2201
mov dword [eax], ecx
mov dword [eax + 4], ecx
push 0x2200
mov dword [eax + 8], ecx
push 1
or ecx, 0xffffffff
sub esp, 0x1c
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe40
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
mov cl, 0x41
mov byte [esp + 0x1810], cl
mov byte [esp + 0x30], cl
push eax
lea ecx, [esp + 0x36]
call fcn.00441690
mov al, byte [esp + 0x30]
lea ecx, [esp + 0x32]
push ecx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x42
mov byte [esp + 0xe4], al
call fcn.00441690
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x1818], 0x43
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43e104
mov ecx, dword [esp + 0xe6]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43e131
mov edx, dword [esp + 0x36]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43e163
mov eax, dword [esp + 0x19e]
push eax
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a3660
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a3df0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a34e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a3910
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a3510
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a34d0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push ebx
mov dword [eax], ecx
mov dword [eax + 4], ecx
push 0x2200
mov dword [eax + 8], ecx
push 1
or ecx, 0xffffffff
sub esp, 0x1c
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe50
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x44
mov byte [esp + 0x34], 0x43
call fcn.00441690
mov cl, byte [esp + 0x30]
lea edx, [esp + 0x32]
mov byte [esp + 0xe0], cl
push edx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x45
call fcn.00441690
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x1818], 0x46
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43e2b3
mov edx, dword [esp + 0xe6]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43e2e0
mov eax, dword [esp + 0x36]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43e312
mov ecx, dword [esp + 0x19e]
push ecx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a05f0
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a2c00
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a2840
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a2ce0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push 3
push 3
push 5
push 0x641
mov ecx, 0x4a27f0
mov dword [eax], ecx
xor ecx, ecx
push 0x640
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe60
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x47
mov byte [esp + 0x34], 0x3f
call fcn.00441690
mov dl, byte [esp + 0x30]
lea eax, [esp + 0x32]
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x48
mov byte [esp + 0xe4], dl
call fcn.00441690
lea ecx, [esp + 0xe0]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esp + 0x1818], 0x49
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43e464
mov eax, dword [esp + 0xe6]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43e491
mov ecx, dword [esp + 0x36]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43e4c3
mov edx, dword [esp + 0x19e]
push edx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a05f0
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a16c0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a11e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a1bc0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a09f0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a0610
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 0xf
push 0xf
push 0xf
push ebx
mov ecx, 0x4a0720
mov dword [eax], ecx
xor ecx, ecx
push ebx
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe68
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
mov byte [esp + 0x1810], 0x4a
mov byte [esp + 0x30], 0x40
push eax
lea ecx, [esp + 0x36]
call fcn.00441690
mov al, byte [esp + 0x30]
lea ecx, [esp + 0x32]
push ecx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x4b
mov byte [esp + 0xe4], al
call fcn.00441690
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x1818], 0x4c
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43e613
mov ecx, dword [esp + 0xe6]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43e640
mov edx, dword [esp + 0x36]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43e672
mov eax, dword [esp + 0x19e]
push eax
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x49fd80
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4a0170
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49fd70
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49fd60
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49fd50
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49fd40
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push 0x2601
mov ecx, 0x49fe90
mov dword [eax], ecx
xor ecx, ecx
push 0x2600
mov dword [eax + 4], ecx
push ebx
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe70
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
mov byte [esp + 0x1810], 0x4d
mov byte [esp + 0x30], 0x30
push eax
lea ecx, [esp + 0x36]
call fcn.00441690
mov cl, byte [esp + 0x30]
lea edx, [esp + 0x32]
mov byte [esp + 0xe0], cl
push edx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x4e
call fcn.00441690
lea eax, [esp + 0xe0]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x1818], 0x4f
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43e7c9
mov edx, dword [esp + 0xe6]
push edx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43e7f6
mov eax, dword [esp + 0x36]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43e828
mov ecx, dword [esp + 0x19e]
push ecx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x49cfd0
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49e700
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49e3a0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49eef0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49d6e0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49d2c0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 3
push 0x1e
push 5
push 0x2601
mov ecx, 0x49c710
mov dword [eax], ecx
xor ecx, ecx
push 0x2600
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe7c
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
mov byte [esp + 0x1810], 0x50
mov byte [esp + 0x30], 0x39
push eax
lea ecx, [esp + 0x36]
call fcn.00441690
mov dl, byte [esp + 0x30]
lea eax, [esp + 0x32]
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x51
mov byte [esp + 0xe4], dl
call fcn.00441690
lea ecx, [esp + 0xe0]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esp + 0x1818], 0x52
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43e980
mov eax, dword [esp + 0xe6]
push eax
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x4a], ebp
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
jb 0x43e9ad
mov ecx, dword [esp + 0x36]
push ecx
call fcn.004aef39
add esp, 4
cmp dword [esp + 0x1b2], ebp
mov dword [esp + 0x4a], 7
mov dword [esp + 0x46], ebx
mov word [esp + 0x36], bx
mov byte [esp + 0x1810], 0x24
jb 0x43e9df
mov edx, dword [esp + 0x19e]
push edx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x49ab60
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49ae00
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49ab70
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49b720
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49af00
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x49ad10
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push ebx
mov ecx, 0x49ab80
mov dword [eax], ecx
xor ecx, ecx
push 0x2601
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe88
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
mov byte [esp + 0x1810], 0x53
mov byte [esp + 0x30], 0x44
push eax
lea ecx, [esp + 0x36]
call fcn.00441690
mov al, byte [esp + 0x30]
lea ecx, [esp + 0x32]
push ecx
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x54
mov byte [esp + 0xe4], al
call fcn.00441690
lea edx, [esp + 0xe0]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x1818], 0x55
call fcn.0042ddb0
cmp dword [esp + 0xfa], ebp
jb 0x43eb33
mov ecx, dword [esp + 0xe6]
push ecx
call fcn.004aef39
add esp, 4
lea ecx, [esp + 0x32]
mov dword [esp + 0xfa], 7
mov dword [esp + 0xf6], ebx
mov word [esp + 0xe6], bx
call fcn.00435530
cmp dword [esp + 0x1b2], ebp
mov byte [esp + 0x1810], 0x24
jb 0x43eb77
mov edx, dword [esp + 0x19e]
push edx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x499830
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push ebx
push ebx
push ebx
push ebx
mov ecx, 0x49a380
mov dword [eax], ecx
xor ecx, ecx
push ebx
mov dword [eax + 4], ecx
push ebx
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbe90
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
mov byte [esp + 0x1810], 0x56
mov byte [esp + 0xe0], 0x66
push eax
lea ecx, [esp + 0xe6]
call fcn.00441690
mov al, byte [esp + 0xe0]
lea ecx, [esp + 0xe2]
push ecx
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x57
mov byte [esp + 0x34], al
call fcn.00441690
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x1818], 0x58
call fcn.0042ddb0
lea ecx, [esp + 0x32]
call fcn.00435530
lea ecx, [esp + 0xe2]
call fcn.00435530
cmp dword [esp + 0x1b2], ebp
mov byte [esp + 0x1810], 0x24
jb 0x43ecd9
mov ecx, dword [esp + 0x19e]
push ecx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4987f0
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x498b40
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x498fc0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x498aa0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 3
push 3
push 3
push 0x2601
mov ecx, 0x498eb0
mov dword [eax], ecx
xor ecx, ecx
push 0x2600
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbea0
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x59
mov byte [esp + 0xe4], 0x3b
call fcn.00441690
mov dl, byte [esp + 0xe0]
lea eax, [esp + 0xe2]
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x5a
mov byte [esp + 0x34], dl
call fcn.00441690
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esp + 0x1818], 0x5b
call fcn.0042ddb0
lea ecx, [esp + 0x32]
call fcn.00435530
lea ecx, [esp + 0xe2]
call fcn.00435530
cmp dword [esp + 0x1b2], ebp
mov byte [esp + 0x1810], 0x24
jb 0x43ee4b
mov eax, dword [esp + 0x19e]
push eax
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x498320
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x498350
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x498380
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x498340
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push ebx
mov dword [eax], ecx
mov dword [eax + 4], ecx
push ebx
mov dword [eax + 8], ecx
push 1
or ecx, 0xffffffff
sub esp, 0x1c
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbeb0
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x5c
mov byte [esp + 0xe4], 0x42
call fcn.00441690
mov cl, byte [esp + 0xe0]
lea edx, [esp + 0xe2]
mov byte [esp + 0x30], cl
push edx
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x5d
call fcn.00441690
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x1818], 0x5e
call fcn.0042ddb0
lea ecx, [esp + 0x32]
call fcn.00435530
lea ecx, [esp + 0xe2]
call fcn.00435530
cmp dword [esp + 0x1b2], ebp
mov byte [esp + 0x1810], 0x24
jb 0x43efb1
mov edx, dword [esp + 0x19e]
push edx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4981a0
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x4981f0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x497c90
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x498080
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x497d60
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x497c80
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x497c30
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push ebx
mov ecx, 0x497d00
mov dword [eax], ecx
xor ecx, ecx
push ebx
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbeb8
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
mov byte [esp + 0x1810], 0x5f
mov byte [esp + 0xe0], 0x29
push eax
lea ecx, [esp + 0xe6]
call fcn.00441690
mov al, byte [esp + 0xe0]
lea ecx, [esp + 0xe2]
push ecx
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x60
mov byte [esp + 0x34], al
call fcn.00441690
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x1818], 0x61
call fcn.0042ddb0
lea ecx, [esp + 0x32]
call fcn.00435530
lea ecx, [esp + 0xe2]
call fcn.00435530
cmp dword [esp + 0x1b2], ebp
mov byte [esp + 0x1810], 0x24
jb 0x43f125
mov ecx, dword [esp + 0x19e]
push ecx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x4970f0
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x497130
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x497b60
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x497210
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x497110
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push ebx
mov ecx, 0x497150
mov dword [eax], ecx
xor ecx, ecx
push ebx
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbec0
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x62
mov byte [esp + 0xe4], 0x45
call fcn.00441690
mov dl, byte [esp + 0xe0]
lea eax, [esp + 0xe2]
push eax
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x63
mov byte [esp + 0x34], dl
call fcn.00441690
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x18]
push edx
mov ecx, edi
mov byte [esp + 0x1818], 0x64
call fcn.0042ddb0
lea ecx, [esp + 0x32]
call fcn.00435530
lea ecx, [esp + 0xe2]
call fcn.00435530
cmp dword [esp + 0x1b2], ebp
mov byte [esp + 0x1810], 0x24
jb 0x43f291
mov eax, dword [esp + 0x19e]
push eax
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x496ba0
mov dword [eax], ecx
mov dword [eax + 4], ebx
xor ecx, ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x497010
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x496b90
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x496e30
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x496b50
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
push 0x1e
push 0x1e
push 5
push ebx
mov ecx, 0x496b80
mov dword [eax], ecx
xor ecx, ecx
push ebx
mov dword [eax + 4], ecx
push 1
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbec8
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x65
mov byte [esp + 0xe4], 0x46
call fcn.00441690
mov cl, byte [esp + 0xe0]
lea edx, [esp + 0xe2]
mov byte [esp + 0x30], cl
push edx
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x66
call fcn.00441690
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x1818], 0x67
call fcn.0042ddb0
lea ecx, [esp + 0x32]
call fcn.00435530
lea ecx, [esp + 0xe2]
call fcn.00435530
cmp dword [esp + 0x1b2], ebp
mov byte [esp + 0x1810], 0x24
jb 0x43f3fd
mov edx, dword [esp + 0x19e]
push edx
call fcn.004aef39
add esp, 4
sub esp, 0x10
mov eax, esp
sub esp, 0x10
mov ecx, 0x495ea0
mov dword [eax], ecx
xor ecx, ecx
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
mov eax, esp
sub esp, 0x10
mov ecx, 0x495ed0
mov dword [eax], ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
sub esp, 0x10
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
sub esp, 0x10
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
mov eax, esp
push ebx
push ebx
push ebx
push ebx
mov ecx, 0x496220
mov dword [eax], ecx
xor ecx, ecx
push ebx
mov dword [eax + 4], ecx
push ebx
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbed4
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
mov byte [esp + 0x1810], 0x68
mov byte [esp + 0xe0], 0x47
push eax
lea ecx, [esp + 0xe6]
call fcn.00441690
mov al, byte [esp + 0xe0]
lea ecx, [esp + 0xe2]
push ecx
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x69
mov byte [esp + 0x34], al
call fcn.00441690
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
mov byte [esp + 0x1818], 0x6a
call fcn.0042ddb0
lea ecx, [esp + 0x30]
call fcn.00441140
lea ecx, [esp + 0xe0]
call fcn.00441140
lea ecx, [esp + 0x19a]
mov byte [esp + 0x1810], 0x24
call fcn.00435530
xor ecx, ecx
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
or ecx, 0xffffffff
sub esp, 0x10
xor edx, edx
mov dword [eax + 4], edx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
xor ecx, ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
xor ecx, ecx
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
xor ecx, ecx
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
xor ecx, ecx
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
xor ecx, ecx
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
mov dword [eax + 0xc], ecx
sub esp, 0x10
xor ecx, ecx
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
or ecx, 0xffffffff
sub esp, 0x10
mov dword [eax + 0xc], ecx
mov eax, esp
push ebx
push ebx
push ebx
push ebx
mov ecx, 0x494ea0
mov dword [eax], ecx
xor ecx, ecx
push ebx
mov dword [eax + 4], ecx
push ebx
sub esp, 0x1c
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov ecx, esp
mov dword [esp + 0xc8], esp
push 0x4fbee0
call fcn.00401430
lea ecx, [esp + 0x24e]
call fcn.0042d7e0
push eax
lea ecx, [esp + 0xe6]
mov byte [esp + 0x1814], 0x6b
mov byte [esp + 0xe4], 0x49
call fcn.00441690
mov cl, byte [esp + 0xe0]
lea edx, [esp + 0xe2]
mov byte [esp + 0x30], cl
push edx
lea ecx, [esp + 0x36]
mov byte [esp + 0x1814], 0x6c
call fcn.00441690
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov byte [esp + 0x1818], 0x6d
call fcn.0042ddb0
lea ecx, [esp + 0x30]
call fcn.00441140
lea ecx, [esp + 0xe0]
call fcn.00441140
lea ecx, [esp + 0x19a]
mov byte [esp + 0x1810], 0x24
call fcn.00435530
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x254]
push eax
lea ecx, [esi + 0x194e0]
mov word [esp + 0x1c], 0x2600
mov byte [esp + 0x1e], 0x44
call fcn.00443810
mov ecx, esi
call fcn.00481290
push ebx
call fcn.004c0de9
mov dword [esi + 0x1a37a], eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esi + 0x1a37e], edx
add esp, 4
mov byte [esp + 0x1810], 0x23
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43f715
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x1810], 0x22
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43f73d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x1810], 0x21
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43f765
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x25c]
mov byte [esp + 0x1810], 0x20
call fcn.004936a0
mov eax, esi
mov ecx, dword [esp + 0x1808]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x17f0]
xor ecx, esp
call fcn.004bfdfd
add esp, 0x1800
ret 8