Function at 0x40976e
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x46e937
call fcn.004549fc
sub esp, 0x138
push ebx
push esi
push edi
mov dword [ebp - 0x6c], ecx
call fcn.00401166
mov dword [ebp - 0x14], eax
mov eax, 0x496f40
mov ecx, eax
mov edi, 0x4765e0
mov esi, 0x4765d8
mov dword [ebp - 0x98], edi
test ecx, ecx
mov dword [ebp - 0x78], esi
jne 0x4097af
mov eax, 0x494ad8
xor ebx, ebx
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.004011a9
mov eax, dword [ebp - 0x90]
mov dword [ebp - 4], ebx
cmp eax, ebx
mov dword [ebp - 0x40], 0x4765fc
je 0x4097d9
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0xf]
push 1
push eax
push 0x48a998
lea ecx, [ebp - 0xcc]
call fcn.00401889
mov eax, dword [eax + 8]
mov byte [ebp - 4], 1
cmp eax, ebx
jne 0x4097ff
mov eax, 0x4765fc
push dword [ebp - 0x40]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x9c], 0xd6
push 0x48a964
push eax
call fcn.0040a580
add esp, 0xc
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], bl
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401093
mov eax, dword [ebp - 0x14]
push 0x496f40
lea ecx, [eax + 0x18]
call fcn.00402936
lea eax, [ebp - 0xf]
push ebx
push eax
push 0x494ad8
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.004011a9
mov eax, dword [0x47665c]
mov dword [ebp - 4], 2
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x409886
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x476654]
mov byte [ebp - 4], 3
cmp eax, ebx
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x78], esi
jne 0x4098af
mov eax, 0x494ad8
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.004011a9
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x98]
push eax
push 5
mov byte [ebp - 4], 4
call fcn.0040a517
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401093
mov ecx, dword [ebp - 0x14]
push 5
call fcn.0040a44f
test al, al
jne 0x4099ae
mov eax, dword [0x47665c]
mov dword [ebp - 0x3c], edi
cmp eax, ebx
mov dword [ebp - 0x1c], esi
jne 0x40992a
mov eax, 0x494ad8
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 5
cmp esi, ebx
jne 0x40994b
mov esi, 0x4765fc
lea eax, [ebp - 0xf]
push 1
push eax
push 0x48a998
lea ecx, [ebp - 0xcc]
call fcn.00401889
mov eax, dword [eax + 8]
mov byte [ebp - 4], 6
cmp eax, ebx
jne 0x409971
mov eax, 0x4765fc
mov dword [ebp - 0xa0], eax
push esi
lea eax, [ebp - 0xa0]
push 0x48a8f8
push eax
mov dword [ebp - 0x9c], 0xdf
call fcn.0040a580
add esp, 0xc
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 5
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
jmp 0x409a10
mov ecx, dword [ebp - 0x6c]
call fcn.0040a647
test al, al
jne 0x409a1c
lea eax, [ebp - 0xe]
push 1
push eax
push 0x48a998
lea ecx, [ebp - 0xcc]
call fcn.00401889
mov eax, dword [eax + 8]
mov dword [ebp - 4], 7
cmp eax, ebx
jne 0x4099e3
mov eax, 0x4765fc
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
push 0x48a8b4
push eax
mov dword [ebp - 0x9c], 0xe7
call fcn.0040a580
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0xcc]
call fcn.00401093
xor eax, eax
jmp 0x40a3e8
mov eax, dword [0x476660]
mov dword [ebp - 0x68], edi
cmp eax, ebx
mov dword [ebp - 0x48], esi
jne 0x409a30
mov eax, 0x494ad8
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x476664]
mov dword [ebp - 4], 8
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409a59
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov ecx, dword [ebp - 0x14]
push 0xa
lea eax, [ebp - 0x68]
push 0x1f40
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 9
call fcn.0042f43b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 8
mov dword [ecx + 0x40], eax
lea ecx, [ebp - 0x3c]
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
mov eax, dword [0x476670]
mov dword [ebp - 0x68], edi
cmp eax, ebx
mov dword [ebp - 0x48], esi
jne 0x409ab4
mov eax, 0x494ad8
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x476654]
mov dword [ebp - 4], 0xa
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409add
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov ecx, dword [ebp - 0x14]
push 0xa
lea eax, [ebp - 0x68]
push 1
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0xb
call fcn.0042f43b
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 0xa
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
cmp dword [ebp - 0x40], 1
jne 0x409b55
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x268]
cmp byte [eax + 1], bl
jne 0x409b3c
cmp byte [eax + 2], bl
jne 0x409b3c
push 1
pop eax
jmp 0x409b3e
xor eax, eax
cmp al, bl
sete al
cmp al, bl
je 0x409b50
mov dword [ecx + 0x38], 1
jmp 0x409b6f
mov dword [ecx + 0x38], ebx
jmp 0x409b6f
push 2
pop eax
cmp dword [ebp - 0x40], eax
jne 0x409b69
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x38], 1
jmp 0x409b6f
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x38], eax
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x494ad8
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x78], esi
call fcn.004011a9
mov eax, dword [0x476678]
mov dword [ebp - 4], 0xc
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x409ba8
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x476654]
mov byte [ebp - 4], 0xd
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409bce
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
mov byte [ebp - 4], 0xe
call fcn.0040a517
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xd
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xc
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401093
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x494ad8
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x78], esi
call fcn.004011a9
mov eax, dword [0x476674]
mov dword [ebp - 4], 0xf
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x409c59
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x476654]
mov byte [ebp - 4], 0x10
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409c7f
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
push 2
mov byte [ebp - 4], 0x11
call fcn.0040a517
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x10
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xf
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401093
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x494ad8
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x78], esi
call fcn.004011a9
mov eax, dword [0x47667c]
mov dword [ebp - 4], 0x12
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x409d0a
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x476654]
mov byte [ebp - 4], 0x13
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409d30
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
push 3
mov byte [ebp - 4], 0x14
call fcn.0040a517
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x13
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x12
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401093
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xcc]
push 7
push eax
call fcn.0040a474
cmp dword [eax + 0xc], ebx
lea ecx, [ebp - 0xcc]
sete byte [ebp - 0xd]
call fcn.00402424
cmp byte [ebp - 0xd], bl
je 0x409f65
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x494ad8
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xac], esi
call fcn.004011a9
mov eax, dword [0x476668]
mov dword [ebp - 4], 0x15
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x409dea
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x476654]
mov byte [ebp - 4], 0x16
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409e10
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0xcc]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
push 7
mov byte [ebp - 4], 0x17
call fcn.0040a517
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x16
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x15
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.00401093
lea eax, [ebp - 0xe]
push ebx
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], 0x476628
mov dword [ebp - 0x78], 0x476620
call fcn.00403bf5
lea eax, [ebp - 0xa4]
push 0x400
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 4], 0x18
call fcn.00402dad
mov ecx, dword [eax]
mov byte [ebp - 4], 0x19
mov byte [eax + 4], 1
call fcn.00403dc2
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x11c]
push 7
push eax
call fcn.0040a474
mov eax, dword [eax + 8]
cmp eax, ebx
jne 0x409ed2
mov eax, 0x476650
push 0x400
push dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x11c]
call fcn.00402424
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x18
call fcn.00402ebf
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x98]
push ebx
push eax
push 7
call fcn.0040a3f7
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 5
je 0x409f56
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x11c]
push 7
push eax
call fcn.0040a474
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x1a
cmp eax, ebx
jne 0x409f37
mov eax, 0x476650
mov ecx, dword [ebp - 0x14]
push 1
push eax
push 0x48a8ac
call fcn.0042e842
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x18
call fcn.00402424
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00402424
mov eax, 0x48a8a8
mov dword [ebp - 0x68], edi
mov ecx, eax
mov dword [ebp - 0x48], esi
test ecx, ecx
jne 0x409f7b
mov eax, 0x494ad8
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x476680]
mov dword [ebp - 4], 0x1b
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409fa4
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov eax, dword [0x476654]
mov byte [ebp - 4], 0x1c
cmp eax, ebx
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xac], esi
jne 0x409fd0
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.004011a9
lea eax, [ebp - 0x68]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0x13
mov byte [ebp - 4], 0x1d
call fcn.0040a517
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x1c
call fcn.00401093
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x1b
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], ebx
jne 0x40a0c0
mov eax, dword [0x47666c]
mov dword [ebp - 0x3c], edi
cmp eax, ebx
mov dword [ebp - 0x1c], esi
jne 0x40a045
mov eax, 0x494ad8
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov eax, dword [0x476654]
mov dword [ebp - 4], 0x1e
cmp eax, ebx
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xac], esi
jne 0x40a074
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.004011a9
mov ecx, dword [ebp - 0x14]
push 0xa
lea eax, [ebp - 0x3c]
push ebx
push eax
lea eax, [ebp - 0xcc]
push eax
mov byte [ebp - 4], 0x1f
call fcn.0042f43b
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x1e
mov dword [ecx + 0x14], eax
lea ecx, [ebp - 0xcc]
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401093
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x494ad8
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
call fcn.004011a9
mov eax, 0x48a88c
mov dword [ebp - 4], 0x20
mov ecx, eax
mov dword [ebp - 0x3c], edi
test ecx, ecx
mov dword [ebp - 0x1c], esi
jne 0x40a0f5
mov eax, 0x494ad8
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov eax, dword [0x476654]
mov byte [ebp - 4], 0x21
cmp eax, ebx
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xac], esi
jne 0x40a121
mov eax, 0x494ad8
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.004011a9
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0xd
mov ecx, esi
mov byte [ebp - 4], 0x22
call fcn.0040a517
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x21
call fcn.00401093
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x20
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
lea eax, [ebp - 0xf4]
push 0xd
push eax
mov ecx, esi
call fcn.0040a474
cmp dword [ebp - 0xe8], 3
mov dword [ebp - 4], 0x23
jbe 0x40a3d6
mov eax, 0x48a884
mov dword [ebp - 0x98], 0x476628
mov ecx, eax
mov dword [ebp - 0x78], 0x476620
test ecx, ecx
jne 0x40a1bd
mov eax, 0x494ad8
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.00403cfd
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x94]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x24
call fcn.0040b120
neg eax
sbb al, al
lea ecx, [ebp - 0x98]
inc al
mov byte [ebp - 4], 0x23
mov byte [ebp - 0xd], al
call fcn.00402424
cmp byte [ebp - 0xd], bl
je 0x40a217
mov byte [esi + 0x4c], 1
jmp 0x40a367
push 1
lea eax, [ebp - 0xe]
pop edi
lea ecx, [ebp - 0x3c]
push edi
push eax
push 0x48a87c
call fcn.00402d75
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x38]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x25
call fcn.0040b120
test eax, eax
je 0x40a2a5
lea eax, [ebp - 0xf]
push edi
push eax
push 0x48a870
lea ecx, [ebp - 0xcc]
call fcn.00402d75
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xc8]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x26
call fcn.0040b120
neg eax
sbb al, al
lea ecx, [ebp - 0xcc]
inc al
mov byte [ebp - 4], 0x25
mov byte [ebp - 0xd], al
call fcn.00402424
cmp byte [ebp - 0xd], bl
mov byte [ebp - 0xd], bl
je 0x40a2a9
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x23
call fcn.00402424
cmp byte [ebp - 0xd], bl
je 0x40a2c3
mov byte [esi + 0x4d], 1
jmp 0x40a367
lea eax, [ebp - 0xe]
push edi
push eax
push 0x48a868
lea ecx, [ebp - 0x3c]
call fcn.00402d75
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x38]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x27
call fcn.0040b120
test eax, eax
je 0x40a34e
lea eax, [ebp - 0xf]
push edi
push eax
push 0x48a85c
lea ecx, [ebp - 0xcc]
call fcn.00402d75
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xc8]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x28
call fcn.0040b120
neg eax
sbb al, al
lea ecx, [ebp - 0xcc]
inc al
mov byte [ebp - 4], 0x27
mov byte [ebp - 0xd], al
call fcn.00402424
cmp byte [ebp - 0xd], bl
mov byte [ebp - 0xd], bl
je 0x40a352
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x23
call fcn.00402424
cmp byte [ebp - 0xd], bl
je 0x40a367
mov byte [esi + 0x4e], 1
lea eax, [ebp - 0x6e]
push 1
push eax
push 0x48a838
lea ecx, [ebp - 0x11c]
call fcn.00401171
lea eax, [ebp - 0x6d]
push 1
push eax
lea ecx, [ebp - 0x144]
push dword [0x476654]
mov byte [ebp - 4], 0x29
call fcn.00401171
push 0xa
lea eax, [ebp - 0x11c]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x144]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x2a
call fcn.0042f43b
lea ecx, [ebp - 0x144]
mov dword [esi + 0x50], eax
mov byte [ebp - 4], 0x29
call fcn.00401093
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x23
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.00402424
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret