Function at 0x414ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb8
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp byte [edx + 0x28], 0
je 0x414ee7
mov byte [eax + 0x40], 2
add esp, 0xb8
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [edx + 0xc]
test esi, esi
je 0x414ed8
xor ebx, ebx
cmp esi, 0xaaaaaab
setb al
jae 0x416ba2
lea ecx, [esi*4]
mov bl, al
lea ecx, [ecx + ecx*2]
shl ebx, 2
test ecx, ecx
js 0x416ba9
mov eax, dword [edx + 4]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x14], eax
je 0x4150ac
mov eax, dword [0x6074b4]
mov esi, dword [0x6074a0]
movzx eax, byte [eax]
mov eax, dword [esi]
test eax, eax
jne 0x414f4c
mov edi, ecx
call sub.KERNEL32.dll_GetProcessHeap
mov ecx, edi
test eax, eax
je 0x4150b6
mov dword [esi], eax
push ecx
push 0
push eax
mov esi, ecx
call sub.KERNEL32.dll_HeapAlloc
mov ecx, esi
test eax, eax
je 0x4150b6
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x68], eax
add eax, 8
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], 0
jmp 0x414fd0
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
push esi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov ebx, eax
test eax, eax
je 0x416ad3
mov edi, esi
mov esi, dword [ebp - 0x10]
add dword [ebp - 0x14], 0xc
inc esi
push edi
push dword [ebp - 0x3c]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], esi
mov dword [eax - 8], ebx
mov dword [eax - 4], edi
mov dword [eax], edi
add ecx, 0xfffffff4
add eax, 0xc
cmp edx, esi
je 0x41502a
test ecx, ecx
je 0x41502a
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
mov esi, dword [edx + 8]
mov edi, dword [edx]
test esi, esi
mov dword [ebp - 0x3c], edi
je 0x415020
js 0x416ae3
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x414f88
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
jne 0x414f80
jmp 0x416ad3
mov ebx, 1
jmp 0x414f9b
mov eax, dword [ebp + 0xc]
movq xmm0, qword [ebp - 0x68]
mov dword [ebp - 0x6c], edx
mov ecx, dword [eax + 0x18]
mov esi, dword [eax + 0x10]
movq qword [ebp - 0x74], xmm0
test ecx, ecx
mov dword [ebp - 0x1c], ecx
je 0x4150c2
xor ebx, ebx
cmp ecx, 0x40000000
setb al
jae 0x416c08
mov bl, al
lea edi, [ecx + ecx]
add ebx, ebx
test edi, edi
js 0x416c08
je 0x4158aa
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x415095
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4158b4
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
push edi
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4158b4
mov ecx, eax
mov ebx, eax
jmp 0x4150c9
mov eax, ebx
test eax, eax
jne 0x414f61
push ecx
push ebx
call fcn.0041a8c0
add esp, 8
ud2
mov ebx, 2
xor edi, edi
mov dword [ebp - 0x34], ebx
push edi
push esi
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x6c]
movsd xmm0, qword [ebp - 0x74]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0xa0], ecx
movzx ecx, byte [edx]
movsd qword [ebp - 0xa8], xmm0
movzx eax, word [edx + 0x24]
movq xmm0, qword [edx + 0x1c]
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], esi
test cl, cl
mov word [ebp - 0x88], ax
movq qword [ebp - 0x90], xmm0
mov byte [ebp - 0x86], cl
je 0x415159
lea eax, [ebp - 0xa8]
cmp esi, 0x15
mov dword [ebp - 0x74], eax
jae 0x41517f
cmp esi, 1
jbe 0x415f5c
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x74]
mov edx, esi
push eax
push 1
call fcn.004063c0
add esp, 8
jmp 0x415f5c
cmp esi, 0x15
jae 0x4158c3
cmp esi, 1
jbe 0x415f5c
mov ecx, dword [ebp - 0x34]
mov edx, esi
push 1
call fcn.00406310
add esp, 4
jmp 0x415f5c
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x4151a7
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x416bf7
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
mov ecx, esi
and ecx, 0x7ffffffe
push ecx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
mov dword [ebp - 0x2c], eax
je 0x416bf7
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x4151eb
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x416c3c
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
push pe_nt_image_headers32
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x416c3c
mov ecx, dword [ebp - 0x34]
mov ebx, eax
xor edi, edi
mov dword [ebp - 0x78], 0x10
lea eax, [ecx - 0x10]
mov dword [ebp - 0xac], eax
lea eax, [ecx - 2]
mov dword [ebp - 0x84], eax
xor eax, eax
jmp 0x415234
mov edi, 1
mov eax, dword [ebp - 0x38]
cmp eax, esi
jae 0x415f40
mov edx, esi
mov dword [ebp - 0x28], edi
mov edi, eax
sub edx, eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], edi
cmp edx, 2
lea ecx, [eax + edi*2]
mov eax, edx
mov dword [ebp - 0x14], ecx
jae 0x4152c0
mov edx, esi
mov ecx, edx
sub ecx, edi
mov dword [ebp - 0x10], ecx
jb 0x416b26
cmp edx, esi
ja 0x416b26
jae 0x415370
cmp eax, 0xa
jae 0x415370
lea edx, [edi + 0xa]
mov ecx, eax
cmp edx, esi
cmovae edx, esi
mov dword [ebp - 0x38], edx
mov edx, edx
sub edx, edi
jb 0x416bb0
mov eax, 1
mov edi, ecx
cmp ecx, 2
cmovb edi, eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x10], edx
push eax
push edi
call fcn.004063c0
add esp, 8
mov edi, dword [ebp - 0x28]
cmp edi, dword [ebp - 0x78]
je 0x41537b
jmp 0x4153e9
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x24], ebx
movzx ebx, word [ecx + 2]
mov edi, ecx
mov edx, dword [eax + 8]
movzx ecx, bx
cmp edx, ecx
jbe 0x4169b5
movzx ebx, word [edi]
movzx esi, bx
cmp edx, esi
jbe 0x4169bc
mov edi, dword [eax]
lea eax, [ecx + ecx*2]
mov ecx, dword [edi + eax*4 + 8]
lea eax, [esi + esi*2]
mov dword [ebp - 0x18], edi
mov eax, dword [edi + eax*4 + 8]
cmp ecx, eax
jbe 0x41571e
cmp dword [ebp - 0x10], 3
mov esi, dword [ebp - 0x1c]
jb 0x415783
mov dword [ebp - 0x30], eax
mov eax, 2
mov dword [ebp - 0x3c], ecx
nop
mov edi, dword [ebp - 0x14]
movzx ebx, word [edi + eax*2]
movzx ecx, bx
cmp edx, ecx
jbe 0x4169b5
movzx ebx, word [edi + eax*2 - 2]
movzx esi, bx
cmp edx, esi
jbe 0x4169bc
mov edi, dword [ebp - 0x18]
lea ecx, [ecx + ecx*2]
lea esi, [esi + esi*2]
mov ecx, dword [edi + ecx*4 + 8]
cmp ecx, dword [edi + esi*4 + 8]
jbe 0x4157a6
inc eax
mov esi, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], eax
jne 0x415320
jmp 0x41577e
mov dword [ebp - 0x38], edx
mov edi, dword [ebp - 0x28]
cmp edi, dword [ebp - 0x78]
jne 0x4153e9
lea eax, [edi + edi]
mov dword [ebp - 0x78], eax
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x4153a9
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x416b72
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
mov edi, dword [ebp - 0x28]
mov ecx, edi
shl ecx, 4
push ecx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x416b72
lea ecx, [edi*8]
push ecx
push ebx
push eax
mov dword [ebp - 0x14], eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
mov dword [ebx + edi*8], eax
mov dword [ebx + edi*8 + 4], ecx
inc edi
cmp edi, 2
jb 0x415229
mov dword [ebp - 0x24], ebx
jmp 0x415478
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov ecx, esi
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x4c]
lea eax, [esi - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebx + edi*8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
sub eax, edx
push eax
push edx
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x18]
add eax, dword [ebp - 0x50]
mov dword [ebx + edi*8 + 8], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebx + edi*8 + 0xc], eax
not edi
lea eax, [ecx + 8]
add edi, esi
shl edi, 3
push edi
push eax
push ecx
call sub.msvcrt.dll_memmove
add esp, 0xc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
cmp edi, 1
jbe 0x415224
mov eax, dword [ebx + edi*8 - 8]
mov ecx, dword [ebx + edi*8 - 4]
add ecx, eax
cmp ecx, esi
je 0x4154d0
mov edx, dword [ebx + edi*8 - 0x10]
cmp edx, eax
jbe 0x4154d0
cmp edi, 3
jb 0x415896
lea ecx, [edi - 3]
lea esi, [edx + eax]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebx + edi*8 - 0x18]
cmp ecx, esi
jbe 0x41570b
mov esi, dword [ebp - 0x1c]
cmp edi, 4
jb 0x4158a0
add edx, ecx
cmp dword [ebx + edi*8 - 0x20], edx
mov edx, dword [ebp - 0x4c]
jbe 0x4154dc
jmp 0x415229
cmp edi, 3
jb 0x4154e0
mov ecx, dword [ebx + edi*8 - 0x18]
lea edx, [edi - 3]
cmp ecx, eax
jb 0x4154e3
lea edx, [edi - 2]
cmp edi, edx
jbe 0x416a5d
lea eax, [edx + 1]
mov dword [ebp - 0x28], edi
cmp edi, eax
jbe 0x416a6b
mov eax, dword [ebx + edx*8 + 8]
mov edi, dword [ebx + edx*8 + 0xc]
mov ecx, dword [ebx + edx*8 + 4]
add edi, eax
mov ebx, edi
sub ebx, ecx
jb 0x416aa8
cmp edi, esi
mov dword [ebp - 0x7c], eax
ja 0x416abc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0xb0], ecx
mov edx, dword [eax + edx*8]
mov eax, dword [ebp - 0x34]
lea ecx, [eax + ecx*2]
mov eax, ebx
mov dword [ebp - 0x50], edx
sub eax, edx
lea esi, [ecx + edx*2]
mov dword [ebp - 0x10], ecx
cmp eax, edx
jae 0x415610
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
push esi
mov ebx, dword [ebp - 0x2c]
push ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x14]
add esp, 0xc
cmp dword [ebp - 0x50], 0
lea ecx, [ebx + eax*2]
mov dword [ebp - 0x68], ebx
jle 0x415410
test eax, eax
jle 0x415410
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x74]
lea edi, [edx + edi*2]
mov dword [ebp - 0x18], eax
nop word cs:[eax + eax]
mov eax, dword [ebp - 0x18]
movzx ebx, word [ecx - 2]
mov edx, dword [eax + 8]
movzx eax, bx
cmp edx, eax
jbe 0x415ef7
movzx ebx, word [esi - 2]
mov dword [ebp - 0x14], ecx
movzx ecx, bx
cmp edx, ecx
jbe 0x415f14
mov edx, dword [ebp - 0x18]
lea eax, [eax + eax*2]
lea ecx, [ecx + ecx*2]
xor ebx, ebx
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 8]
mov edx, dword [edx + ecx*4 + 8]
xor ecx, ecx
cmp eax, edx
seta cl
setbe bl
add ecx, ecx
add ebx, ebx
sub esi, ecx
mov ecx, dword [ebp - 0x14]
sub ecx, ebx
cmp eax, edx
mov eax, ecx
cmova eax, esi
cmp esi, dword [ebp - 0x10]
movzx eax, word [eax]
mov word [edi], ax
jbe 0x415410
add edi, 0xfffffffe
cmp ecx, dword [ebp - 0x2c]
ja 0x415590
jmp 0x415410
lea eax, [edx + edx]
push eax
push ecx
push dword [ebp - 0x2c]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x50]
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
test eax, eax
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x14], ecx
jle 0x415700
cmp ebx, eax
jle 0x415700
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
lea eax, [eax + edi*2]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x80], eax
nop word [eax + eax]
mov eax, dword [ebp - 0x20]
movzx ebx, word [esi]
mov edx, dword [eax + 8]
movzx edi, bx
cmp edx, edi
jbe 0x415f04
mov dword [ebp - 0x44], esi
mov esi, dword [ebp - 0x18]
movzx ebx, word [esi]
movzx eax, bx
cmp edx, eax
jbe 0x415f1f
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x20]
lea edx, [edi + edi*2]
mov dword [ebp - 0x40], edi
mov ecx, dword [ecx]
mov edx, dword [ecx + edx*4 + 8]
mov dword [ebp - 0x48], ecx
mov edi, dword [ebp - 0x48]
mov dword [ebp - 0x3c], edx
lea edx, [eax + eax*2]
mov dword [ebp - 0x30], edx
mov ebx, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x30]
cmp ebx, dword [edi + ecx*4 + 8]
mov ecx, dword [ebp - 0x10]
cmova eax, dword [ebp - 0x40]
mov word [ecx], ax
mov eax, 0
setbe al
lea esi, [esi + eax*2]
seta al
add ecx, 2
cmp esi, dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
jae 0x4156e9
mov esi, dword [ebp - 0x44]
mov dl, al
lea esi, [esi + edx*2]
cmp esi, dword [ebp - 0x80]
jb 0x415660
mov edx, dword [ebp - 0x18]
jmp 0x415418
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
jmp 0x415418
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x4c]
cmp ecx, eax
jae 0x4154e0
jmp 0x4154e3
cmp dword [ebp - 0x10], 3
mov esi, dword [ebp - 0x1c]
jb 0x415793
mov dword [ebp - 0x30], eax
mov eax, 2
mov dword [ebp - 0x3c], ecx
nop word cs:[eax + eax]
nop dword [eax]
mov edi, dword [ebp - 0x14]
movzx ebx, word [edi + eax*2]
movzx ecx, bx
cmp edx, ecx
jbe 0x4169b5
movzx ebx, word [edi + eax*2 - 2]
movzx esi, bx
cmp edx, esi
jbe 0x4169bc
mov edi, dword [ebp - 0x18]
lea ecx, [ecx + ecx*2]
lea esi, [esi + esi*2]
mov ecx, dword [edi + ecx*4 + 8]
cmp ecx, dword [edi + esi*4 + 8]
ja 0x4157a6
inc eax
mov esi, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], eax
jne 0x415740
mov eax, dword [ebp - 0x10]
jmp 0x4157a9
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov eax, 2
lea edx, [edi + 2]
jmp 0x4157be
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov eax, 2
lea edx, [edi + 2]
jmp 0x415252
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
cmp dword [ebp - 0x3c], ecx
lea edx, [eax + edi]
jbe 0x415252
cmp edx, edi
jb 0x416c0f
cmp edx, esi
ja 0x416c2b
cmp eax, 2
jb 0x415252
mov dword [ebp - 0x38], edx
mov edx, eax
xor ecx, ecx
mov dword [ebp - 0x10], eax
shr edx, 1
cmp eax, 0x10
jb 0x415850
lea ecx, [edi + eax]
mov edi, dword [ebp - 0xac]
mov ebx, edx
and ebx, 0xfffffff8
mov eax, ebx
lea edi, [edi + ecx*2]
mov ecx, dword [ebp - 0x14]
nop
movdqu xmm0, xmmword [ecx]
movdqu xmm1, xmmword [edi]
pshufd xmm1, xmm1, 0x4e
pshufd xmm0, xmm0, 0x4e
pshuflw xmm1, xmm1, 0x1b
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm1, xmm1, 0x1b
pshufhw xmm0, xmm0, 0x1b
movdqu xmmword [ecx], xmm1
movdqu xmmword [edi], xmm0
add edi, 0xfffffff0
add ecx, 0x10
add ebx, 0xfffffff8
jne 0x415800
mov ecx, eax
cmp edx, eax
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
jne 0x415850
mov edx, dword [ebp - 0x38]
jmp 0x415252
sub edx, ecx
add ecx, ecx
mov esi, ecx
mov ecx, edi
add edi, eax
add edi, edi
lea eax, [esi + ecx*2]
sub edi, esi
add eax, dword [ebp - 0x34]
add edi, dword [ebp - 0x84]
nop word [eax + eax]
movzx ecx, word [eax]
movzx esi, word [edi]
mov word [eax], si
mov word [edi], cx
add eax, 2
add edi, 0xfffffffe
dec edx
jne 0x415870
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
jmp 0x415252
mov edi, 2
jmp 0x415229
mov edi, 3
jmp 0x415229
mov eax, ebx
test eax, eax
jne 0x4150a6
push edi
push ebx
call fcn.0041a8c0
add esp, 8
jmp 0x416c82
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x4158eb
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x416bf7
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
mov ecx, esi
and ecx, 0x7ffffffe
push ecx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
mov dword [ebp - 0x20], eax
je 0x416bf7
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x41592f
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x416c6e
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
push pe_nt_image_headers32
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x416c6e
mov ecx, dword [ebp - 0x34]
mov edi, eax
xor edx, edx
mov dword [ebp - 0x24], 0x10
lea eax, [ecx - 0x10]
mov dword [ebp - 0x7c], eax
lea eax, [ecx - 2]
mov dword [ebp - 0x4c], eax
xor eax, eax
jmp 0x415980
mov edx, 1
mov eax, dword [ebp - 0x28]
cmp eax, esi
jae 0x415ee2
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x40], edi
mov edi, eax
mov dword [ebp - 0x18], eax
mov eax, esi
mov dword [ebp - 0x44], edx
sub esi, edi
cmp esi, 2
mov dword [ebp - 0x14], esi
lea ecx, [ecx + edi*2]
mov dword [ebp - 0x10], ecx
jae 0x415a90
mov edx, eax
mov esi, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov edi, edx
sub edi, eax
jb 0x416aed
cmp edx, esi
ja 0x416aed
jae 0x415ac0
cmp ecx, 0xa
jae 0x415ac0
lea edi, [eax + 0xa]
cmp edi, esi
cmovae edi, esi
mov dword [ebp - 0x28], edi
sub edi, eax
jb 0x416b1f
cmp ecx, 2
mov eax, ecx
mov ecx, 1
cmovb eax, ecx
mov ecx, dword [ebp - 0x10]
mov edx, edi
push eax
call fcn.00406310
add esp, 4
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x24]
jne 0x415acf
lea eax, [edx + edx]
mov dword [ebp - 0x24], eax
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x415a3e
mov ebx, edx
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x416b06
mov ecx, dword [0x6074a0]
mov edx, ebx
mov dword [ecx], eax
mov ecx, edx
shl ecx, 4
push ecx
push 0
push eax
mov ebx, edx
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x416b06
lea ecx, [ebx*8]
push ecx
mov ebx, dword [ebp - 0x40]
push ebx
push eax
mov dword [ebp - 0x14], eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
jmp 0x415ad2
movzx edi, word [ecx]
movzx esi, word [ecx + 2]
cmp si, di
jae 0x415d60
cmp dword [ebp - 0x14], 2
jne 0x415d79
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov ecx, 2
lea edx, [eax + 2]
jmp 0x415dec
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0x44]
cmp edx, dword [ebp - 0x24]
je 0x415a0c
mov ebx, dword [ebp - 0x40]
mov dword [ebx + edx*8], edi
mov dword [ebx + edx*8 + 4], eax
inc edx
mov edi, ebx
cmp edx, 2
jb 0x415975
mov dword [ebp - 0x40], edi
jmp 0x415b41
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
sub eax, ecx
push eax
push ecx
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x30]
mov dword [edi + eax*8 + 8], ecx
mov ecx, dword [ebp - 0x80]
mov dword [edi + eax*8 + 0xc], ecx
mov ecx, dword [ebp - 0x3c]
not eax
add ecx, eax
lea eax, [edx + 8]
shl ecx, 3
push ecx
push eax
push edx
call sub.msvcrt.dll_memmove
add esp, 0xc
mov edx, dword [ebp - 0x44]
cmp edx, 1
jbe 0x415970
mov eax, dword [edi + edx*8 - 8]
mov ecx, dword [edi + edx*8 - 4]
mov ebx, edx
add ecx, eax
cmp ecx, esi
je 0x415ba0
mov edx, dword [edi + ebx*8 - 0x10]
cmp edx, eax
jbe 0x415ba0
cmp ebx, 3
jb 0x415ec7
lea ecx, [ebx - 3]
lea esi, [edx + eax]
mov dword [ebp - 0x48], ecx
mov ecx, dword [edi + ebx*8 - 0x18]
cmp ecx, esi
jbe 0x415d4d
mov esi, dword [ebp - 0x1c]
cmp ebx, 4
jb 0x415ed1
add edx, ecx
cmp dword [edi + ebx*8 - 0x20], edx
mov edx, dword [ebp - 0x48]
jbe 0x415bac
jmp 0x415edb
cmp ebx, 3
jb 0x415bb0
mov ecx, dword [edi + ebx*8 - 0x18]
lea edx, [ebx - 3]
cmp ecx, eax
jb 0x415bb3
lea edx, [ebx - 2]
cmp ebx, edx
jbe 0x4169d7
lea eax, [edx + 1]
cmp ebx, eax
jbe 0x4169e5
mov esi, ebx
mov eax, dword [edi + edx*8 + 8]
mov ebx, dword [edi + edx*8 + 0xc]
mov ecx, dword [edi + edx*8 + 4]
add ebx, eax
mov edi, ebx
sub edi, ecx
jb 0x416a1f
mov dword [ebp - 0x2c], eax
mov eax, ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x10], ebx
cmp ebx, eax
ja 0x416a33
mov eax, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x80], ecx
dec eax
lea ecx, [esi + ecx*2]
mov esi, edi
mov dword [ebp - 0x44], eax
lea eax, [ebx + edx*8]
mov edx, dword [ebx + edx*8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x50], eax
sub esi, edx
lea ebx, [ecx + edx*2]
mov dword [ebp - 0x30], edx
cmp esi, edx
jae 0x415cc0
lea eax, [esi + esi]
push eax
push ebx
mov edi, esi
mov esi, dword [ebp - 0x20]
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp - 0x30], 0
lea eax, [esi + edi*2]
mov dword [ebp - 0x18], eax
jle 0x415cb5
mov esi, dword [ebp - 0x1c]
test edi, edi
jle 0x415d3d
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x10]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
nop word cs:[eax + eax]
nop dword [eax]
movzx eax, word [ecx - 2]
movzx edx, word [ebx - 2]
mov esi, 0
mov edi, 0
cmp ax, dx
sbb esi, esi
cmp ax, dx
adc edi, 0xffffffff
cmp ax, dx
lea ebx, [ebx + esi*2]
mov edx, dword [ebp - 0x10]
lea ecx, [ecx + edi*2]
mov eax, ecx
cmovb eax, ebx
cmp ebx, dword [ebp - 0x14]
movzx eax, word [eax]
mov word [edx], ax
jbe 0x415cb2
add dword [ebp - 0x10], 0xfffffffe
cmp ecx, dword [ebp - 0x20]
ja 0x415c70
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
jmp 0x415af3
lea eax, [edx + edx]
push eax
push ecx
mov esi, dword [ebp - 0x20]
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x30]
add esp, 0xc
test eax, eax
lea ecx, [esi + eax*2]
mov dword [ebp - 0x18], ecx
jle 0x415aea
mov esi, dword [ebp - 0x1c]
cmp edi, eax
jle 0x415d45
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x10]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
nop dword [eax + eax]
movzx esi, word [ebx]
movzx edi, word [ecx]
xor eax, eax
xor edx, edx
cmp si, di
cmovb edi, esi
mov esi, dword [ebp - 0x14]
setae al
lea ecx, [ecx + eax*2]
setb al
mov word [esi], di
add esi, 2
cmp ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], esi
jae 0x415aed
mov dl, al
lea ebx, [ebx + edx*2]
cmp ebx, dword [ebp - 0x10]
jb 0x415d00
jmp 0x415aed
mov ecx, dword [ebp - 0x20]
jmp 0x415af3
mov ecx, dword [ebp - 0x20]
jmp 0x415af0
mov edx, dword [ebp - 0x48]
cmp ecx, eax
jae 0x415bb0
jmp 0x415bb3
cmp dword [ebp - 0x14], 2
jne 0x415da8
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov ecx, 2
lea edx, [eax + 2]
jmp 0x4159ae
mov ecx, edi
mov edi, 2
mov ebx, esi
nop word cs:[eax + eax]
nop dword [eax]
mov eax, dword [ebp - 0x10]
mov edx, ebx
movzx ebx, word [eax + edi*2]
cmp bx, dx
jae 0x415dd8
mov eax, dword [ebp - 0x14]
inc edi
cmp eax, edi
jne 0x415d90
jmp 0x415dd6
mov ecx, edi
mov edi, 2
mov ebx, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
mov eax, dword [ebp - 0x10]
mov edx, ebx
movzx ebx, word [eax + edi*2]
cmp bx, dx
jb 0x415dd8
mov eax, dword [ebp - 0x14]
inc edi
cmp eax, edi
jne 0x415dc0
mov edi, eax
mov eax, dword [ebp - 0x18]
cmp si, cx
mov esi, dword [ebp - 0x1c]
mov ecx, edi
lea edx, [edi + eax]
jae 0x4159ae
cmp edx, eax
jb 0x416b42
cmp edx, esi
ja 0x416b5e
cmp ecx, 2
jb 0x4159ae
mov dword [ebp - 0x28], edx
mov edx, ecx
xor ebx, ebx
shr edx, 1
cmp ecx, 0x10
jb 0x415e7d
mov edi, ecx
mov ecx, eax
mov ebx, edx
mov dword [ebp - 0x14], edi
lea ecx, [eax + edi]
mov edi, dword [ebp - 0x7c]
and ebx, 0xfffffff8
mov eax, ebx
lea edi, [edi + ecx*2]
mov ecx, dword [ebp - 0x10]
nop dword [eax]
movdqu xmm0, xmmword [ecx]
movdqu xmm1, xmmword [edi]
pshufd xmm1, xmm1, 0x4e
pshufd xmm0, xmm0, 0x4e
pshuflw xmm1, xmm1, 0x1b
pshuflw xmm0, xmm0, 0x1b
pshufhw xmm1, xmm1, 0x1b
pshufhw xmm0, xmm0, 0x1b
movdqu xmmword [ecx], xmm1
movdqu xmmword [edi], xmm0
add edi, 0xfffffff0
add ecx, 0x10
add ebx, 0xfffffff8
jne 0x415e30
mov ebx, eax
cmp edx, eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
jne 0x415e7d
mov edx, dword [ebp - 0x28]
jmp 0x4159ae
mov esi, eax
sub edx, ebx
add ebx, ebx
mov eax, ecx
lea edi, [esi + ecx]
mov ecx, esi
lea ecx, [ebx + esi*2]
add edi, edi
add ecx, dword [ebp - 0x34]
sub edi, ebx
add edi, dword [ebp - 0x4c]
nop word [eax + eax]
movzx ebx, word [ecx]
movzx esi, word [edi]
mov word [ecx], si
mov word [edi], bx
add ecx, 2
add edi, 0xfffffffe
dec edx
jne 0x415ea0
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov ecx, eax
mov eax, edi
jmp 0x4159ae
mov edx, 2
jmp 0x415975
mov edx, 3
jmp 0x415975
mov edx, ebx
jmp 0x415975
push edi
push 0
mov esi, dword [0x6074a0]
push dword [esi]
call sub.KERNEL32.dll_HeapFree
push dword [ebp - 0x20]
jmp 0x415f53
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x64], ecx
mov ecx, 0x59bb30
jmp 0x415f2a
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x60], ecx
mov ecx, 0x59bb30
jmp 0x415f2a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x64], eax
jmp 0x415f25
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x60], ecx
mov ecx, 0x59bb40
movzx eax, bx
push ecx
push edx
push eax
mov esi, dword [ebp - 0x1c]
call fcn.00425270
add esp, 0xc
jmp 0x416c82
push ebx
push 0
mov esi, dword [0x6074a0]
push dword [esi]
call sub.KERNEL32.dll_HeapFree
push dword [ebp - 0x2c]
push 0
push dword [esi]
call sub.KERNEL32.dll_HeapFree
mov ebx, dword [ebp - 0xa0]
test ebx, ebx
je 0x416bba
mov eax, dword [ebp - 0x90]
cmp eax, 1
mov esi, eax
je 0x415f95
test eax, eax
je 0x416c52
lea ecx, [eax - 1]
mov esi, 1
nop word [eax + eax]
add esi, esi
dec ecx
jne 0x415f90
mov dword [ebp - 0x20], eax
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x415fc0
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x416b8e
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
push 0x300
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x416b8e
mov dword [eax], 4
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 4
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 4
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 4
mov dword [eax + 0x28], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x30], 4
mov dword [eax + 0x34], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 4
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 4
mov dword [eax + 0x4c], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x54], 4
mov dword [eax + 0x58], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x60], 4
mov dword [eax + 0x64], 0
mov dword [eax + 0x68], 0
mov dword [eax + 0x6c], 4
mov dword [eax + 0x70], 0
mov dword [eax + 0x74], 0
mov dword [eax + 0x78], 4
mov dword [eax + 0x7c], 0
mov dword [eax + 0x80], 0
mov dword [eax + 0x84], 4
mov dword [eax + 0x88], 0
mov dword [eax + 0x8c], 0
mov dword [eax + 0x90], 4
mov dword [eax + 0x94], 0
mov dword [eax + 0x98], 0
mov dword [eax + 0x9c], 4
mov dword [eax + 0xa0], 0
mov dword [eax + 0xa4], 0
mov dword [eax + 0xa8], 4
mov dword [eax + 0xac], 0
mov dword [eax + 0xb0], 0
mov dword [eax + 0xb4], 4
mov dword [eax + 0xb8], 0
mov dword [eax + 0xbc], 0
mov dword [eax + 0xc0], 4
mov dword [eax + 0xc4], 0
mov dword [eax + 0xc8], 0
mov dword [eax + 0xcc], 4
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0
mov dword [eax + 0xd8], 4
mov dword [eax + 0xdc], 0
mov dword [eax + 0xe0], 0
mov dword [eax + 0xe4], 4
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov dword [eax + 0xf0], 4
mov dword [eax + 0xf4], 0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 4
mov dword [eax + 0x100], 0
mov dword [eax + 0x104], 0
mov dword [eax + 0x108], 4
mov dword [eax + 0x10c], 0
mov dword [eax + 0x110], 0
mov dword [eax + 0x114], 4
mov dword [eax + 0x118], 0
mov dword [eax + 0x11c], 0
mov dword [eax + 0x120], 4
mov dword [eax + 0x124], 0
mov dword [eax + 0x128], 0
mov dword [eax + 0x12c], 4
mov dword [eax + 0x130], 0
mov dword [eax + 0x134], 0
mov dword [eax + 0x138], 4
mov dword [eax + 0x13c], 0
mov dword [eax + 0x140], 0
mov dword [eax + 0x144], 4
mov dword [eax + 0x148], 0
mov dword [eax + 0x14c], 0
mov dword [eax + 0x150], 4
mov dword [eax + 0x154], 0
mov dword [eax + 0x158], 0
mov dword [eax + 0x15c], 4
mov dword [eax + 0x160], 0
mov dword [eax + 0x164], 0
mov dword [eax + 0x168], 4
mov dword [eax + 0x16c], 0
mov dword [eax + 0x170], 0
mov dword [eax + 0x174], 4
mov dword [eax + 0x178], 0
mov dword [eax + 0x17c], 0
mov dword [eax + 0x180], 4
mov dword [eax + 0x184], 0
mov dword [eax + 0x188], 0
mov dword [eax + 0x18c], 4
mov dword [eax + 0x190], 0
mov dword [eax + 0x194], 0
mov dword [eax + 0x198], 4
mov dword [eax + 0x19c], 0
mov dword [eax + 0x1a0], 0
mov dword [eax + 0x1a4], 4
mov dword [eax + 0x1a8], 0
mov dword [eax + 0x1ac], 0
mov dword [eax + 0x1b0], 4
mov dword [eax + 0x1b4], 0
mov dword [eax + 0x1b8], 0
mov dword [eax + 0x1bc], 4
mov dword [eax + 0x1c0], 0
mov dword [eax + 0x1c4], 0
mov dword [eax + 0x1c8], 4
mov dword [eax + 0x1cc], 0
mov dword [eax + 0x1d0], 0
mov dword [eax + 0x1d4], 4
mov dword [eax + 0x1d8], 0
mov dword [eax + 0x1dc], 0
mov dword [eax + 0x1e0], 4
mov dword [eax + 0x1e4], 0
mov dword [eax + 0x1e8], 0
mov dword [eax + 0x1ec], 4
mov dword [eax + 0x1f0], 0
mov dword [eax + 0x1f4], 0
mov dword [eax + 0x1f8], 4
mov dword [eax + 0x1fc], 0
mov dword [eax + 0x200], 0
mov dword [eax + 0x204], 4
mov dword [eax + 0x208], 0
mov dword [eax + 0x20c], 0
mov dword [eax + 0x210], 4
mov dword [eax + 0x214], 0
mov dword [eax + 0x218], 0
mov dword [eax + 0x21c], 4
mov dword [eax + 0x220], 0
mov dword [eax + 0x224], 0
mov dword [eax + 0x228], 4
mov dword [eax + 0x22c], 0
mov dword [eax + 0x230], 0
mov dword [eax + 0x234], 4
mov dword [eax + 0x238], 0
mov dword [eax + 0x23c], 0
mov dword [eax + 0x240], 4
mov dword [eax + 0x244], 0
mov dword [eax + 0x248], 0
mov dword [eax + 0x24c], 4
mov dword [eax + 0x250], 0
mov dword [eax + 0x254], 0
mov dword [eax + 0x258], 4
mov dword [eax + 0x25c], 0
mov dword [eax + 0x260], 0
mov dword [eax + 0x264], 4
mov dword [eax + 0x268], 0
mov dword [eax + 0x26c], 0
mov dword [eax + 0x270], 4
mov dword [eax + 0x274], 0
mov dword [eax + 0x278], 0
mov dword [eax + 0x27c], 4
mov dword [eax + 0x280], 0
mov dword [eax + 0x284], 0
mov dword [eax + 0x288], 4
mov dword [eax + 0x28c], 0
mov dword [eax + 0x290], 0
mov dword [eax + 0x294], 4
mov dword [eax + 0x298], 0
mov dword [eax + 0x29c], 0
mov dword [eax + 0x2a0], 4
mov dword [eax + 0x2a4], 0
mov dword [eax + 0x2a8], 0
mov dword [eax + 0x2ac], 4
mov dword [eax + 0x2b0], 0
mov dword [eax + 0x2b4], 0
mov dword [eax + 0x2b8], 4
mov dword [eax + 0x2bc], 0
mov dword [eax + 0x2c0], 0
mov dword [eax + 0x2c4], 4
mov dword [eax + 0x2c8], 0
mov dword [eax + 0x2cc], 0
mov dword [eax + 0x2d0], 4
mov dword [eax + 0x2d4], 0
mov dword [eax + 0x2d8], 0
mov dword [eax + 0x2dc], 4
mov dword [eax + 0x2e0], 0
mov dword [eax + 0x2e4], 0
mov dword [eax + 0x2e8], 4
mov dword [eax + 0x2ec], 0
mov dword [eax + 0x2f0], 0
mov dword [eax + 0x2f4], 4
mov dword [eax + 0x2f8], 0
mov dword [eax + 0x2fc], 0
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], 0x40
mov dword [ebp - 0x6c], 0x40
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0xa0]
lea edx, [eax + 1]
mov dword [ebp - 0xb8], ecx
movzx edx, dx
cmp ecx, edx
mov dword [ebp - 0xb4], edx
jne 0x416bce
mov ecx, dword [ebp - 0x6c]
movq xmm0, qword [ebp - 0x74]
mov edx, dword [ebp - 0x20]
cmp ebx, 2
mov dword [ebp - 0x48], ebx
movq qword [ebp - 0x68], xmm0
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], esi
mov word [ebp - 0x54], ax
mov eax, dword [ebp - 0xa8]
mov esi, dword [ebp - 0x94]
mov dword [ebp - 0x10], ecx
mov edi, dword [ebp - 0x68]
mov dword [ebp - 0x30], eax
mov eax, 1
mov dword [ebp - 0x40], esi
cmovae eax, ebx
xor ecx, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x3c], eax
jmp 0x4167b5
mov edx, dword [esi + 8]
mov eax, dword [esi]
movzx ecx, word [ebp - 0x14]
mov dword [eax + edx*8], ebx
mov word [eax + edx*8 + 4], cx
inc edx
cmp edi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x48]
mov ecx, edi
mov dword [esi + 8], edx
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x40]
je 0x41682b
cmp ecx, esi
je 0x41698b
mov eax, dword [ebp - 0x3c]
mov edi, ecx
movzx eax, word [eax + ecx*2]
movzx ecx, ax
cmp ebx, ecx
jbe 0x416994
mov ebx, dword [ebp - 0x30]
lea ecx, [ecx + ecx*2]
mov word [ebp - 0x14], ax
mov eax, dword [ebx + ecx*4 + 8]
cmp edx, eax
ja 0x416a49
mov eax, dword [ebx + ecx*4]
inc edi
xor ebx, ebx
mov ecx, edx
nop
movzx edx, byte [eax]
inc eax
dec ecx
lea ebx, [edx + ebx*2]
jne 0x4167f0
mov ecx, ebx
and ecx, 0x3f
cmp ecx, dword [ebp - 0x10]
jae 0x41699b
lea eax, [ecx + ecx*2]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + eax*4 + 8]
lea esi, [ecx + eax*4]
cmp edx, dword [ecx + eax*4 + 4]
jne 0x416793
mov ecx, esi
call fcn.00406a40
jmp 0x416790
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x5c]
mov esi, dword [ebp - 0x64]
movsd xmm0, qword [eax]
mov eax, dword [eax + 8]
test byte [ecx + 1], 1
movsd qword [ebp - 0xc4], xmm0
mov dword [ebp - 0xbc], eax
jne 0x416884
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
lea edi, [ecx + 4]
mov byte [eax + 0x40], 2
jmp 0x41686c
add edi, 0xc
dec dword [ebp - 0x10]
je 0x4168fa
cmp dword [edi], 0
je 0x416860
push dword [edi - 4]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x416860
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp + 8]
movsd xmm1, qword [ebp - 0x98]
movsd xmm0, qword [ebp - 0x90]
movsd xmm2, qword [ebp - 0xa8]
mov edx, dword [ebp - 0x10]
mov dword [ecx + 0x3c], eax
movsd qword [ecx + 0x2c], xmm1
movsd xmm1, qword [ebp - 0xa0]
mov eax, dword [ebp - 0xbc]
movsd qword [ecx + 0x34], xmm0
movsd qword [ecx + 0x1c], xmm2
movsd qword [ecx + 0x24], xmm1
movq xmm1, qword [ebp - 0xc4]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x18]
movq qword [ecx + 0xc], xmm1
mov dword [ecx], eax
mov eax, ecx
mov dword [ecx + 4], esi
mov dword [eax + 8], edx
mov dword [eax + 0x18], 0
mov byte [eax + 0x40], 1
jmp 0x414edc
test esi, esi
je 0x41690f
push dword [ebp - 0x18]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [ebp - 0xa0]
mov esi, dword [ebp - 0xa8]
test edi, edi
je 0x41694e
lea ebx, [esi + 4]
jmp 0x416936
add ebx, 0xc
dec edi
je 0x41694e
cmp dword [ebx], 0
je 0x416930
push dword [ebx - 4]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x416930
cmp dword [ebp - 0xa4], 0
je 0x416966
push esi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp dword [ebp - 0x98], 0
je 0x416983
push dword [ebp - 0x9c]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [ebp + 8]
jmp 0x414edc
mov eax, 0x59bb70
mov ebx, esi
jmp 0x4169a5
mov eax, 0x59bb60
jmp 0x4169a3
mov ebx, dword [ebp - 0x10]
mov eax, 0x59bbfc
mov esi, ecx
push eax
push ebx
push esi
call fcn.00425270
add esp, 0xc
jmp 0x416c82
mov ecx, 0x59bb30
jmp 0x4169c4
mov esi, dword [ebp - 0x1c]
mov ecx, 0x59bb40
movzx eax, bx
push ecx
push edx
push eax
call fcn.00425270
add esp, 0xc
jmp 0x416c82
mov dword [ebp - 0x68], 0x59a710
mov eax, 0x59a800
jmp 0x4169f1
mov eax, 0x59a810
mov dword [ebp - 0x68], 0x59a710
lea ecx, [ebp - 0x68]
mov dword [ecx + 4], 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 8], 0x59a6fc
mov dword [ecx + 0xc], 0
push eax
push ecx
call fcn.00425150
add esp, 8
jmp 0x416c82
push 0x59a820
push ebx
push ecx
call fcn.00428850
add esp, 0xc
jmp 0x416c82
push 0x59a820
push eax
push dword [ebp - 0x10]
call fcn.004287f0
add esp, 0xc
jmp 0x416c82
push 0x59bbec
push eax
push edx
call fcn.004287f0
add esp, 0xc
jmp 0x416c82
mov dword [ebp - 0x68], 0x59a710
mov eax, 0x59a800
jmp 0x416a77
mov eax, 0x59a810
mov dword [ebp - 0x68], 0x59a710
lea ecx, [ebp - 0x68]
mov dword [ecx + 4], 1
mov dword [ecx + 0x10], 0
mov dword [ecx + 8], 0x59a6fc
mov dword [ecx + 0xc], 0
push eax
push ecx
mov esi, dword [ebp - 0x1c]
call fcn.00425150
add esp, 8
jmp 0x416c82
push 0x59a820
push edi
push ecx
call fcn.00428850
add esp, 0xc
jmp 0x416c82
push 0x59a820
mov esi, dword [ebp - 0x1c]
push esi
push edi
call fcn.004287f0
add esp, 0xc
jmp 0x416c82
push esi
push 1
call fcn.0041a8c0
add esp, 8
jmp 0x416c82
call fcn.0041a880
jmp 0x416c82
push 0x59a89c
push 0x2c
push 0x59a870
call fcn.004251d0
add esp, 0xc
jmp 0x416c82
push 0x59a850
push 0x2b
push 0x59a670
call fcn.004251d0
add esp, 0xc
jmp 0x416c82
mov eax, 0x59a860
jmp 0x416b4a
mov dword [ebp - 0x24], ebx
push 0x59a89c
push 0x2c
push 0x59a870
call fcn.004251d0
add esp, 0xc
jmp 0x416c82
mov eax, 0x59a7f0
mov dword [ebp - 0x28], edx
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x18]
call fcn.00428850
add esp, 0xc
jmp 0x416c82
push 0x59a7f0
push esi
push edx
call fcn.004287f0
add esp, 0xc
jmp 0x416c82
mov dword [ebp - 0x24], ebx
push 0x59a850
push 0x2b
push 0x59a670
call fcn.004251d0
add esp, 0xc
jmp 0x416c82
push 0x300
push 4
call fcn.0041a8c0
add esp, 8
jmp 0x416c82
call fcn.0041a880
ud2
call fcn.0041a880
ud2
mov dword [ebp - 0x24], ebx
mov eax, 0x59a860
jmp 0x416c17
mov eax, 0x59bc64
mov ecx, 0x25
mov edx, 0x59bc3c
jmp 0x416c61
mov dword [ebp - 0x68], 0
lea eax, [ebp - 0x68]
lea edx, [ebp - 0xb8]
lea ecx, [ebp - 0xb4]
push 0x59bb50
push eax
call fcn.00406530
add esp, 8
jmp 0x416c82
mov eax, 0x59a830
mov ecx, 0x2b
mov edx, 0x59a670
jmp 0x416c61
call fcn.0041a880
jmp 0x416c82
mov eax, 0x59a7f0
mov dword [ebp - 0x38], edx
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
call fcn.00428850
add esp, 0xc
jmp 0x416c82
push 0x59a7f0
push esi
push edx
call fcn.004287f0
add esp, 0xc
jmp 0x416c82
push 0x59a840
push 0x2b
push 0x59a670
call fcn.004251d0
add esp, 0xc
jmp 0x416c82
mov eax, 0x59bc2c
mov ecx, 0x1f
mov edx, 0x59bc0c
push eax
push ecx
push edx
call fcn.004251d0
add esp, 0xc
jmp 0x416c82
push 0x59a840
push 0x2b
push 0x59a670
call fcn.004251d0
add esp, 0xc
ud2