Function at 0x410be0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ca41
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x300
mov eax, dword [0x474010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x2a0], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 0x294], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x290], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebx + 0x34]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x298], eax
mov eax, dword [ebx + 0x3c]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebx + 0x44]
mov dword [ebp - 0x270], eax
mov dword [ebp - 4], 1
cmp dword [ecx], 0xffffffff
je 0x411ef7
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x1b
movups xmmword [ecx], xmm0
push str.106091104099095100087106091
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x2e0]
call fcn.0041dc90
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x410d04
mov eax, dword [eax]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x2cc]
mov edi, eax
cmp ecx, 0x10
jb 0x410d49
mov edx, dword [ebp - 0x2e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x410d3f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411f93
push ecx
push edx
call fcn.00436385
add esp, 8
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], 0xf
mov byte [ebp - 0x2e0], 0
call edi
mov edi, dword [ebp - 0x2a0]
push dword [edi]
call dword [ebp - 0x298]
push 0
push dword [edi]
call dword [ebp - 0x28c]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x104
lea eax, [ebp - 0x220]
mov dword [esi], 0
push eax
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x21
movups xmmword [ecx], xmm0
push str.075073059072070072069060063066059
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x26c]
call fcn.0041deb0
add esp, 0x18
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x410dd7
mov eax, dword [eax]
push eax
call dword [ebp - 0x29c]
mov byte [ebp - 4], 1
mov esi, eax
mov ecx, dword [ebp - 0x258]
cmp ecx, 8
jb 0x410e24
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410e1a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411f98
push ecx
push edx
call fcn.00436385
add esp, 8
test esi, esi
je 0x411ef7
cmp esi, 0x104
ja 0x411ef7
xorps xmm0, xmm0
mov dword [ebp - 0x22c], 0
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x228], 0
movups xmmword [ebp - 0x23c], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410e60
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0041a540
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x228]
mov eax, edx
mov ecx, dword [ebp - 0x22c]
sub eax, ecx
cmp eax, 1
jb 0x410ebd
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
mov dword [eax + ecx*2], 0x5c
jmp 0x410ede
push 1
push 0x46b5b4
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x15
movups xmmword [ecx], xmm0
push str.055102102058087106087
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x26c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 4
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x410f22
mov edx, dword [edx]
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
sub eax, ecx
mov dword [ebp - 0x28c], ecx
cmp edi, eax
ja 0x410f78
cmp dword [ebp - 0x228], 8
lea eax, [ecx + edi]
lea esi, [ebp - 0x23c]
mov dword [ebp - 0x22c], eax
cmovae esi, dword [ebp - 0x23c]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x28c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x410f93
push edi
push edx
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push edi
call fcn.0041a270
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x258]
cmp ecx, 8
jb 0x410fd7
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x410fcd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411f9d
push ecx
push edx
call fcn.00436385
add esp, 8
mov edx, dword [ebp - 0x228]
mov eax, edx
mov ecx, dword [ebp - 0x22c]
sub eax, ecx
cmp eax, 1
jb 0x41100e
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
mov dword [eax + ecx*2], 0x5c
jmp 0x41102f
push 1
push 0x46b5b4
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xf
movups xmmword [ecx], xmm0
push str.066101089087098
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x26c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 5
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x411073
mov edx, dword [edx]
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
sub eax, ecx
mov dword [ebp - 0x28c], ecx
cmp edi, eax
ja 0x4110c9
cmp dword [ebp - 0x228], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x23c]
mov dword [ebp - 0x22c], eax
cmovae esi, dword [ebp - 0x23c]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x28c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x4110e4
push edi
push edx
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push edi
call fcn.0041a270
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x258]
cmp ecx, 8
jb 0x411128
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41111e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fa2
push ecx
push edx
call fcn.00436385
add esp, 8
mov edx, dword [ebp - 0x228]
mov eax, edx
mov ecx, dword [ebp - 0x22c]
sub eax, ecx
cmp eax, 1
jb 0x41115f
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
mov dword [eax + ecx*2], 0x5c
jmp 0x411180
push 1
push 0x46b5b4
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xc
movups xmmword [ecx], xmm0
push str.074091099102
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x26c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 6
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x4111c4
mov edx, dword [edx]
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
sub eax, ecx
mov dword [ebp - 0x28c], ecx
cmp edi, eax
ja 0x41121a
cmp dword [ebp - 0x228], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x23c]
mov dword [ebp - 0x22c], eax
cmovae esi, dword [ebp - 0x23c]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x28c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x411235
push edi
push edx
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push edi
call fcn.0041a270
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x258]
cmp ecx, 8
jb 0x411279
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41126f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fa7
push ecx
push edx
call fcn.00436385
add esp, 8
mov edx, dword [ebp - 0x228]
mov eax, edx
mov ecx, dword [ebp - 0x22c]
sub eax, ecx
cmp eax, 1
jb 0x4112b0
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
mov dword [eax + ecx*2], 0x5c
jmp 0x4112d1
push 1
push 0x46b5b4
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push 1
call fcn.0041a270
mov ecx, dword [ebp - 0x228]
mov eax, ecx
mov edi, dword [ebp - 0x22c]
sub eax, edi
cmp eax, 8
jb 0x41131b
cmp ecx, 8
lea esi, [ebp - 0x23c]
lea eax, [edi + 8]
cmovae esi, dword [ebp - 0x23c]
push 0x10
mov dword [ebp - 0x22c], eax
push str.10105060
lea eax, [esi + edi*2]
push eax
call fcn.00437650
add esp, 0xc
xor eax, eax
mov word [esi + edi*2 + 0x10], ax
jmp 0x41133c
push 8
push str.10105060
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push 8
call fcn.0041a270
mov edx, dword [ebp - 0x228]
mov eax, edx
mov ecx, dword [ebp - 0x22c]
sub eax, ecx
cmp eax, 1
jb 0x411373
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
mov dword [eax + ecx*2], 0x2e
jmp 0x411394
push 1
push 0x46b348
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 9
movups xmmword [ecx], xmm0
push str.106110106
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x26c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 7
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x4113d8
mov edx, dword [edx]
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
sub eax, ecx
mov dword [ebp - 0x28c], ecx
cmp edi, eax
ja 0x41142e
cmp dword [ebp - 0x228], 8
lea eax, [ecx + edi]
lea esi, [ebp - 0x23c]
mov dword [ebp - 0x22c], eax
cmovae esi, dword [ebp - 0x23c]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x28c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x411449
push edi
push edx
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x23c]
push dword [ebp - 0x28c]
push edi
call fcn.0041a270
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x258]
cmp ecx, 8
jb 0x41148d
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411483
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fac
push ecx
push edx
call fcn.00436385
add esp, 8
xorps xmm0, xmm0
mov dword [ebp - 0x244], 0
xor eax, eax
mov dword [ebp - 0x240], 7
movups xmmword [ebp - 0x254], xmm0
mov word [ebp - 0x254], ax
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4114c1
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x254]
call fcn.00416850
mov edx, dword [ebp - 0x240]
mov eax, edx
mov ecx, dword [ebp - 0x244]
sub eax, ecx
cmp eax, 1
jb 0x41151a
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
mov dword [eax + ecx*2], 0x5c
jmp 0x41153b
push 1
push 0x46b5b4
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x254]
push dword [ebp - 0x28c]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x15
movups xmmword [ecx], xmm0
push str.055102102058087106087
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x26c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 9
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x41157f
mov edx, dword [edx]
mov ecx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
sub eax, ecx
mov dword [ebp - 0x28c], ecx
cmp edi, eax
ja 0x4115d5
cmp dword [ebp - 0x240], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x254]
mov dword [ebp - 0x244], eax
cmovae esi, dword [ebp - 0x254]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x28c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x4115f0
push edi
push edx
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x254]
push dword [ebp - 0x28c]
push edi
call fcn.0041a270
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x258]
cmp ecx, 8
jb 0x411634
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41162a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fb1
push ecx
push edx
call fcn.00436385
add esp, 8
mov edx, dword [ebp - 0x240]
mov eax, edx
mov ecx, dword [ebp - 0x244]
sub eax, ecx
cmp eax, 1
jb 0x41166b
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
mov dword [eax + ecx*2], 0x5c
jmp 0x41168c
push 1
push 0x46b5b4
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x254]
push dword [ebp - 0x28c]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xf
movups xmmword [ecx], xmm0
push str.066101089087098
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x26c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xa
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x4116d0
mov edx, dword [edx]
mov ecx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
sub eax, ecx
mov dword [ebp - 0x28c], ecx
cmp edi, eax
ja 0x411726
cmp dword [ebp - 0x240], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x254]
mov dword [ebp - 0x244], eax
cmovae esi, dword [ebp - 0x254]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x28c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x411741
push edi
push edx
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x254]
push dword [ebp - 0x28c]
push edi
call fcn.0041a270
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x258]
cmp ecx, 8
jb 0x411785
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41177b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fb6
push ecx
push edx
call fcn.00436385
add esp, 8
mov edx, dword [ebp - 0x240]
mov eax, edx
mov ecx, dword [ebp - 0x244]
sub eax, ecx
cmp eax, 1
jb 0x4117bc
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
mov dword [eax + ecx*2], 0x5c
jmp 0x4117dd
push 1
push 0x46b5b4
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x254]
push dword [ebp - 0x28c]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0xc
movups xmmword [ecx], xmm0
push str.074091099102
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x26c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xb
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x411821
mov edx, dword [edx]
mov ecx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
sub eax, ecx
mov dword [ebp - 0x28c], ecx
cmp edi, eax
ja 0x411877
cmp dword [ebp - 0x240], 8
lea eax, [ecx + edi]
lea esi, [ebp - 0x254]
mov dword [ebp - 0x244], eax
cmovae esi, dword [ebp - 0x254]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x28c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x411892
push edi
push edx
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x254]
push dword [ebp - 0x28c]
push edi
call fcn.0041a270
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x258]
cmp ecx, 8
jb 0x4118d6
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4118cc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fbb
push ecx
push edx
call fcn.00436385
add esp, 8
mov edx, dword [ebp - 0x240]
mov eax, edx
mov ecx, dword [ebp - 0x244]
sub eax, ecx
cmp eax, 1
jb 0x41190d
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
mov dword [eax + ecx*2], 0x5c
jmp 0x41192e
push 1
push 0x46b5b4
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x254]
push dword [ebp - 0x28c]
push 1
call fcn.0041a270
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 0x2a
movups xmmword [ecx], xmm0
push str.064107099102076095091109075095036090098098
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x26c]
call fcn.0041deb0
add esp, 0x18
mov edx, eax
mov byte [ebp - 4], 0xc
cmp dword [edx + 0x14], 8
mov edi, dword [edx + 0x10]
jb 0x411972
mov edx, dword [edx]
mov ecx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
sub eax, ecx
mov dword [ebp - 0x28c], ecx
cmp edi, eax
ja 0x4119c8
cmp dword [ebp - 0x240], 8
lea eax, [edi + ecx]
lea esi, [ebp - 0x254]
mov dword [ebp - 0x244], eax
cmovae esi, dword [ebp - 0x254]
lea eax, [edi + edi]
push eax
push edx
lea ecx, [esi + ecx*2]
push ecx
call fcn.00437650
mov eax, dword [ebp - 0x28c]
add esp, 0xc
add eax, edi
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x4119e3
push edi
push edx
mov byte [ebp - 0x28c], 0
lea ecx, [ebp - 0x254]
push dword [ebp - 0x28c]
push edi
call fcn.0041a270
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x258]
cmp ecx, 8
jb 0x411a27
mov edx, dword [ebp - 0x26c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411a1d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fc0
push ecx
push edx
call fcn.00436385
add esp, 8
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push eax
call dword [ebp - 0x270]
cmp eax, 0xffffffff
je 0x411a4b
test al, 0x10
je 0x411abd
sub esp, 0x18
lea eax, [ebx + 0x60]
mov ecx, esp
push eax
call fcn.004148c0
push dword [ebp - 0x2b0]
lea eax, [ebp - 0x224]
mov ecx, 2
push dword [ebp - 0x298]
lea edx, [ebp - 0x270]
push dword [ebp - 0x2b4]
push dword [ebp - 0x29c]
push dword [ebp - 0x2b8]
push dword [ebp - 0x2bc]
push dword [ebp - 0x2c0]
push dword [ebp - 0x2c4]
push dword [ebp - 0x2a4]
push dword [ebp - 0x2a8]
push dword [ebp - 0x2ac]
push dword [ebp - 0x290]
push eax
push 0
call fcn.00405920
add esp, 0x50
cmp dword [ebp - 0x240], 8
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x294]
sub esp, 0x18
mov ecx, esp
xorps xmm0, xmm0
mov dword [esi], eax
push 6
movups xmmword [ecx], xmm0
push str.107102
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x2e0]
call fcn.0041dc90
add esp, 0x18
cmp dword [eax + 0x14], 0x10
jb 0x411b1b
mov eax, dword [eax]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x2cc]
mov dword [ebp - 0x290], eax
cmp ecx, 0x10
jb 0x411b64
mov edx, dword [ebp - 0x2e0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411b5a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fc5
push ecx
push edx
call fcn.00436385
add esp, 8
cmp dword [ebx + 0x5c], 8
lea ecx, [ebx + 0x48]
mov eax, dword [ebx + 0x58]
cmovae ecx, dword [ebx + 0x48]
mov dword [ebp - 0x2d0], 0
mov dword [ebp - 0x2cc], 0xf
mov byte [ebp - 0x2e0], 0
lea eax, [ecx + eax*2]
lea ecx, [ebx + 0x48]
cmovae ecx, dword [ebx + 0x48]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x310]
call fcn.00418e20
mov esi, eax
sub esp, 0x18
mov byte [ebp - 4], 0xd
mov ecx, esp
xorps xmm0, xmm0
push 0x15
movups xmmword [ecx], xmm0
push str.037097111098101093037
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
lea ecx, [ebp - 0x2f8]
call fcn.0041dc90
add esp, 0x18
push esi
push eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x26c]
push dword [ebp - 0x224]
call fcn.0041c4a0
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x2e4]
cmp ecx, 0x10
jb 0x411c33
mov edx, dword [ebp - 0x2f8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411c29
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fca
push ecx
push edx
call fcn.00436385
add esp, 8
mov dword [ebp - 0x2e8], 0
mov dword [ebp - 0x2e4], 0xf
mov byte [ebp - 0x2f8], 0
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x2fc]
cmp ecx, 0x10
jb 0x411c8c
mov edx, dword [ebp - 0x310]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411c82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fca
push ecx
push edx
call fcn.00436385
add esp, 8
cmp dword [ebx + 0x74], 0x10
lea ecx, [ebx + 0x60]
mov eax, dword [ebx + 0x70]
lea edi, [ebx + 0x60]
cmovae ecx, dword [ebx + 0x60]
xorps xmm0, xmm0
add eax, ecx
mov dword [ebp - 0x300], 0
cmp dword [ebx + 0x74], 0x10
mov dword [ebp - 0x2fc], 0xf
cmovae edi, dword [ebx + 0x60]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x224], esp
mov byte [ebp - 0x310], 0
mov dword [ebp - 0x294], eax
push 6
movups xmmword [ecx], xmm0
push str.lg.txt
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0041a9a0
sub esp, 0x18
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x2ac], esp
mov ecx, esp
push eax
call fcn.004143d0
sub esp, 0x18
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x2a8], esp
mov ecx, esp
push eax
call fcn.004148c0
sub esp, 0x18
mov byte [ebp - 4], 0x14
mov ecx, esp
push ecx
push dword [ebp - 0x294]
push edi
call fcn.00419270
mov byte [ebp - 4], 0x11
call dword [ebp - 0x290]
cmp dword [ebp - 0x228], 8
lea ecx, [ebp - 0x23c]
mov eax, dword [ebp - 0x22c]
cmovae ecx, dword [ebp - 0x23c]
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x23c]
cmovae ecx, dword [ebp - 0x23c]
add esp, 0x5c
push eax
push ecx
lea ecx, [ebp - 0x288]
call fcn.00418e20
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x288]
cmp dword [ebp - 0x274], 0x10
cmovae eax, dword [ebp - 0x288]
push eax
call dword [ebp - 0x2c8]
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0x274]
mov dword [eax], 0xffffffff
cmp ecx, 0x10
jb 0x411de8
mov edx, dword [ebp - 0x288]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411dde
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fcf
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0xf
mov byte [ebp - 0x288], 0
cmp ecx, 0x10
jb 0x411e3d
mov edx, dword [ebp - 0x26c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411e33
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fcf
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebp - 0x240]
cmp ecx, 8
jb 0x411e7d
mov edx, dword [ebp - 0x254]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411e73
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fcf
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebp - 0x228]
xor eax, eax
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 7
mov word [ebp - 0x254], ax
cmp ecx, 8
jb 0x411eda
mov edx, dword [ebp - 0x23c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411ed0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fcf
push ecx
push edx
call fcn.00436385
add esp, 8
xor eax, eax
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 7
mov word [ebp - 0x23c], ax
mov ecx, dword [ebx + 0x5c]
cmp ecx, 8
jb 0x411f31
mov edx, dword [ebx + 0x48]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x411f27
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fcf
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebx + 0x74]
xor eax, eax
mov dword [ebx + 0x58], 0
mov dword [ebx + 0x5c], 7
mov word [ebx + 0x48], ax
cmp ecx, 0x10
jb 0x411f75
mov edx, dword [ebx + 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x411f6b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x411fcf
push ecx
push edx
call fcn.00436385
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00436030
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
call fcn.004432a9
int3