Function at 0x4340b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0xec]
cmp eax, dword [ecx + 8]
jbe 0x435a5a
sub esp, 0x16c
mov ecx, dword [esp + 0x170]
movzx edx, word [ecx + 2]
movzx ebx, word [ecx]
cmp dx, bx
jne 0x435a42
mov dword [esp + 0xf8], 0
mov dword [esp + 0xfc], 0
lea edx, [ecx + 0xc]
mov dword [esp + 0xf4], edx
movzx edx, word [ecx + 2]
mov dword [esp + 0xf8], edx
movzx edx, word [ecx + 2]
mov dword [esp + 0x60], edx
mov dword [esp + 0xfc], edx
mov ebx, dword [esp + 0xf8]
mov dword [esp + 0x24], ebx
mov ebp, dword [esp + 0xf4]
mov dword [esp + 0x9c], ebp
mov esi, dword [0x7283e8]
mov edi, dword [0x7283ec]
test esi, esi
xchg esi, ebx
seta bl
xchg esi, ebx
test edi, edi
mov eax, edx
sete dl
and edx, esi
test edi, edi
xchg esi, ebx
seta bl
xchg esi, ebx
or edx, esi
test dl, dl
jne 0x4358f7
xor edx, edx
xor esi, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0
mov dword [esp + 0x108], 0
mov edi, dword [ecx + 4]
mov dword [esp + 0x100], edi
movzx edi, word [ecx + 2]
mov dword [esp + 0x104], edi
movzx edi, word [ecx + 2]
mov dword [esp + 0x108], edi
mov edi, dword [esp + 0x100]
mov esi, dword [esp + 0x104]
mov dword [esp + 0x6c], eax
mov eax, 1
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x6c]
jmp 0x434209
mov word [edi + ebp*2], cx
mov word [edi + edx*2], bp
mov eax, dword [esp + 0x170]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x170]
mov edx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x9c]
mov dword [esp + 0x3c], ebx
mov ebx, dword [esp + 0x24]
movzx edx, word [ecx + 2]
mov ebp, dword [esp + 0x3c]
cmp ebp, edx
jge 0x434272
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
mov ebx, dword [edx + 0x8c]
mov dword [esp + 0x48], ebx
sar ebx, 0x1f
and ebx, 0xa8888eef
mov ecx, dword [esp + 0x48]
shl ecx, 1
xor ecx, ebx
mov dword [edx + 0x8c], ecx
lea edx, [ebp + 1]
test edx, edx
je 0x435a34
mov eax, ecx
mov ebx, edx
xor edx, edx
div ebx
cmp edx, esi
jae 0x435a2d
movzx ecx, word [edi + edx*2]
cmp ebp, esi
jb 0x4341dc
jmp 0x435a2d
mov dword [esp + 0xa8], edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x10c], 0
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], 0
mov edx, dword [ecx + 8]
mov dword [esp + 0x10c], edx
movzx edx, word [ecx + 2]
mov dword [esp + 0x110], edx
movzx edx, word [ecx + 2]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x114], edx
mov ebp, dword [esp + 0x10c]
mov dword [esp + 0xb0], ebp
mov edx, dword [esp + 0x110]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x64], eax
xor eax, eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x64]
jmp 0x43439e
mov ebp, dword [esp + 0xb0]
mov word [ebp + ecx*2], di
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0x58]
mov edi, dword [esp + 0xa8]
test ecx, ecx
jle 0x43434f
lea edi, [ecx - 1]
sar edi, 0x1f
shr edi, 0x1f
lea edi, [ecx + edi - 1]
sar edi, 1
cmp edi, edx
jae 0x435a1f
mov dword [esp + 0x58], edi
movzx edi, word [ebp + edi*2]
movzx ebp, di
cmp ebp, ebx
jae 0x435a1f
imul ebp, ebp, 0x1c
mov ebp, dword [esi + ebp + 4]
cmp ebp, eax
jae 0x43434f
cmp ecx, edx
jb 0x4342ee
jmp 0x435a18
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0xa8]
movzx edi, word [ebp + eax*2]
cmp ecx, edx
jae 0x435a11
mov edx, dword [esp + 0xb0]
mov word [edx + ecx*2], di
inc eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x170]
mov edx, dword [esp + 0x2c]
mov ebp, dword [esp + 0xb0]
mov esi, edi
mov edi, dword [esp + 0xa8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x60]
movzx eax, word [ecx + 2]
mov ecx, dword [esp + 0x38]
cmp ecx, eax
jge 0x4343d8
cmp ecx, esi
jae 0x435a26
movzx eax, word [edi + ecx*2]
cmp eax, ebx
jae 0x435a26
imul eax, eax, 0x1c
mov esi, dword [esp + 0x9c]
mov eax, dword [esi + eax + 4]
mov dword [esp + 0xc0], eax
jmp 0x43430c
dec eax
mov ecx, dword [esp + 0x9c]
jmp 0x4344d2
mov word [ebp + ecx*2], ax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0xbc]
mov edi, dword [esp + 0x30]
mov ecx, esi
mov esi, dword [esp + 0xbc]
mov dword [esp + 0x34], edi
shl edi, 1
lea esi, [edi + 1]
cmp esi, eax
jge 0x43452f
mov dword [esp + 0x30], esi
lea ecx, [edi + 2]
cmp ecx, eax
jge 0x434526
cmp esi, edx
jae 0x4359f5
movzx eax, word [ebp + edi*2 + 2]
cmp eax, ebx
jae 0x4359f5
imul eax, eax, 0x1c
mov esi, dword [esp + 0x9c]
mov eax, dword [eax + esi + 4]
cmp ecx, edx
jae 0x4359ee
movzx edi, word [ebp + edi*2 + 4]
cmp edi, ebx
jae 0x4359ee
imul edi, edi, 0x1c
mov edi, dword [edi + esi + 4]
cmp eax, edi
jae 0x43451d
mov eax, dword [esp + 0xbc]
mov edi, eax
cmp ecx, edx
jae 0x4359e7
mov dword [esp + 0x30], ecx
movzx eax, word [ebp + ecx*2]
movzx ecx, ax
cmp ecx, ebx
jae 0x4359e7
imul ecx, ecx, 0x1c
mov ecx, dword [esi + ecx + 4]
cmp edi, ecx
jae 0x4344aa
mov ecx, dword [esp + 0x34]
cmp ecx, edx
jb 0x4343e5
jmp 0x4359e0
mov eax, dword [esp + 0x34]
cmp eax, edx
jae 0x4359d9
movzx ecx, word [esp + 0x1a]
mov word [ebp + eax*2], cx
mov eax, dword [esp + 0x44]
dec eax
mov ecx, esi
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0xa8]
test eax, eax
jl 0x434536
cmp eax, edx
jae 0x435a0a
movzx edi, word [ebp + eax*2]
movzx esi, di
cmp esi, ebx
jae 0x435a03
imul esi, esi, 0x1c
mov esi, dword [ecx + esi + 4]
test edx, edx
jbe 0x4359fc
mov dword [esp + 0x44], eax
mov word [esp + 0x1a], di
mov dword [esp + 0xbc], esi
movzx edi, word [ebp]
mov word [ebp + eax*2], di
xor edi, edi
jmp 0x434402
mov ecx, dword [esp + 0x30]
jmp 0x434469
mov esi, dword [esp + 0x9c]
jmp 0x43451d
mov esi, ecx
jmp 0x4344aa
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x60]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebp
mov dword [esp + 0x10], edx
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x14], esi
call fcn.00433f00
mov dword [esp + 0x4c], 0
jmp 0x4357df
inc eax
mov dword [esp + 0x50], edx
mov dword [esp + 0xb8], ecx
mov ebx, dword [esp + 0x170]
movzx ebp, word [ebx + 2]
cmp eax, ebp
jge 0x434a58
mov ebp, dword [esp + 0x28]
cmp eax, ebp
jae 0x4359d2
mov esi, dword [esp + 0xa8]
movzx edi, word [esi + eax*2]
mov esi, dword [esp + 0x24]
cmp edi, esi
jae 0x4359cb
mov dword [esp + 0x58], edi
mov dword [esp + 0x40], eax
imul edi, edi, 0x1c
mov dword [esp + 0x54], edi
mov esi, dword [esp + 0x9c]
lea ebp, [edi + esi]
mov dword [esp + 0xf0], ebp
mov ebx, dword [esi + edi + 4]
mov dword [esp + 0xc8], ebx
movzx edi, word [esi + edi + 0xc]
cmp di, 1
ja 0x4348a6
test di, di
je 0x434567
test byte [ebx], al
lea eax, [ebx + 0x28]
mov dword [esp], eax
call fcn.00404950
mov eax, dword [esp + 4]
test eax, eax
jne 0x4347de
mov eax, dword [esp + 0xc8]
mov ecx, dword [eax]
test ecx, ecx
ja 0x43470f
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x43463c
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x9c]
mov edx, ecx
mov ecx, eax
mov eax, dword [esp + 0x40]
jmp 0x434567
mov eax, dword [esp + 0x9c]
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x14], ecx
call fcn.00433f90
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x9c]
mov edx, dword [ecx + eax + 0x10]
test edx, edx
je 0x43468c
mov byte [edx], 0
mov eax, dword [ecx + eax]
test eax, eax
jne 0x4346f7
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0x58]
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x14]
test eax, eax
seta bl
test edx, edx
xchg ebp, ebx
sete bl
xchg ebp, ebx
and ebp, ebx
test edx, edx
setg bl
or ebx, ebp
test bl, bl
jne 0x4346cd
mov dword [esp + 0x174], ecx
add esp, 0x16c
ret
mov dword [esp + 0x50], ecx
mov ecx, dword [esp + 0x1c]
sub eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x20]
sbb edx, eax
mov dword [esp + 4], edx
mov dword [esp + 8], 1
call fcn.00421650
mov ecx, dword [esp + 0x50]
jmp 0x4346bf
mov ecx, dword [esp + 0xc8]
mov ecx, dword [ecx + 0x14]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0040f1a0
jmp 0x434693
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x9c]
mov ebx, dword [edx + ecx + 0x10]
test ebx, ebx
je 0x434725
mov byte [ebx], 1
mov ebx, dword [eax + 0x1c]
mov ecx, dword [edx + ecx]
mov ebp, dword [eax + 8]
movzx esi, word [eax + 0xc]
imul esi, ebx
mov ebx, ebp
add ebx, esi
test ecx, ecx
jne 0x4347b7
mov ecx, dword [eax + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], ebx
call fcn.0040f1a0
mov eax, dword [esp + 0xc8]
mov ecx, dword [eax + 0x1c]
inc ecx
mov dword [eax + 0x1c], ecx
mov edx, dword [eax + 4]
cmp edx, ecx
jne 0x434768
mov dword [eax + 0x1c], 0
mov ecx, dword [eax]
dec ecx
mov dword [eax], ecx
mov eax, dword [esp + 0x9c]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
call fcn.00433f90
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0x58]
jmp 0x43469e
mov dword [esp + 0x74], ebx
mov edx, dword [eax + 0x14]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], ebx
call fcn.0040ed60
mov eax, dword [esp + 0xc8]
mov ebx, dword [esp + 0x74]
jmp 0x43473d
mov dword [esp + 0x98], eax
lea edi, [esp + 0x150]
xor eax, eax
call fcn.0044bde9
lea ecx, [0x449a00]
mov dword [esp + 0x150], ecx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x154], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x158], edx
mov edx, dword [esp + 0x60]
mov dword [esp + 0x15c], edx
mov edx, dword [esp + 0xb0]
mov dword [esp + 0x160], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x164], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x168], edx
mov edx, dword [esp + 0x54]
mov ebx, dword [ecx + edx]
mov dword [esp + 8], ebx
mov ebx, dword [esp + 0xc8]
mov dword [esp], ebx
mov ebx, dword [esp + 0x98]
mov dword [esp + 4], ebx
lea ebx, [esp + 0x150]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 2
call fcn.004046d0
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x9c]
mov ecx, dword [edx + ecx + 0x10]
test ecx, ecx
je 0x434896
mov byte [ecx], 1
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0x58]
jmp 0x43469e
cmp di, 2
je 0x4348c6
cmp di, 3
jne 0x4348bd
mov eax, ebp
mov ecx, dword [esp + 0x58]
jmp 0x434628
mov eax, ecx
mov ecx, edx
jmp 0x434628
mov edi, dword [ebx + 0x10]
test edi, edi
jne 0x43597e
lea eax, [ebx + 0x20]
mov dword [esp], eax
call fcn.00404950
mov eax, dword [esp + 4]
test eax, eax
jne 0x4349a6
mov eax, dword [esp + 0xc8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
cmp ecx, edx
jb 0x434908
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x50]
jmp 0x434628
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
mov ebx, dword [esp + 0x54]
mov ebp, dword [esp + 0x9c]
mov ebx, dword [ebp + ebx]
mov esi, dword [eax + 8]
movzx edi, word [eax + 0xc]
imul edi, edx
mov edx, esi
add edx, edi
mov dword [esp + 8], ebx
mov dword [esp], ecx
mov dword [esp + 4], edx
call fcn.0040ed60
mov eax, dword [esp + 0xc8]
mov ecx, dword [eax + 0x18]
inc ecx
mov dword [eax + 0x18], ecx
mov edx, dword [eax + 4]
cmp edx, ecx
jne 0x434957
mov dword [eax + 0x18], 0
mov ecx, dword [eax]
inc ecx
mov dword [eax], ecx
mov eax, dword [esp + 0x9c]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
call fcn.00433f90
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0x58]
jmp 0x43469e
mov dword [esp + 0x98], eax
lea edi, [esp + 0x134]
xor eax, eax
call fcn.0044bde9
lea ecx, [0x449a50]
mov dword [esp + 0x134], ecx
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x138], ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x13c], edx
mov edx, dword [esp + 0x60]
mov dword [esp + 0x140], edx
mov edx, dword [esp + 0xb0]
mov dword [esp + 0x144], edx
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x148], edx
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x14c], edx
mov edx, dword [esp + 0x54]
mov ecx, dword [ecx + edx]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0xc8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x98]
mov dword [esp + 4], ecx
lea ecx, [esp + 0x134]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 2
call fcn.00403b60
mov eax, dword [esp + 0xf0]
mov ecx, dword [esp + 0x58]
jmp 0x43469e
test ecx, ecx
jne 0x4358ad
mov eax, dword fs:[0x14]
mov eax, dword [eax]
mov dword [esp + 0x4c], 0
mov ecx, dword [eax + 0xb4]
lea edx, [eax + 0xb4]
test ecx, ecx
jne 0x435966
mov dword [esp + 0xb4], eax
mov dword [esp + 0xec], edx
mov ecx, edx
xor ebp, ebp
mov esi, dword [esp + 0xb0]
jmp 0x434abd
add esi, 2
inc ebp
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xec]
mov ebx, dword [esp + 0x170]
mov edi, dword [esp + 0x2c]
cmp ebp, edi
jge 0x434fa6
movzx ebx, word [esi]
mov ecx, dword [esp + 0x24]
cmp ebx, ecx
jae 0x43595f
imul ebx, ebx, 0x1c
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x9c]
movzx ebx, word [eax + ebx + 0xc]
test bx, bx
je 0x434aa4
mov dword [esp + 0x54], ebp
mov dword [esp + 0xac], edx
mov dword [esp + 0xe8], esi
mov ecx, dword [esp + 0x58]
mov edx, dword [eax + ecx + 4]
mov dword [esp + 0xc4], edx
call fcn.004288a0
mov eax, dword [esp]
mov dword [esp + 0x8c], eax
test byte [eax], al
mov ecx, dword [0x728500]
lea edx, [eax + 4]
test ecx, ecx
jne 0x434f5e
mov ecx, dword [esp + 0xb4]
mov dword [eax], ecx
lea edx, [esp + 0x4c]
mov dword [eax + 4], edx
mov ebx, dword [0x728500]
lea ebp, [eax + 0x10]
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x9c]
mov edx, dword [edi + esi]
test ebx, ebx
jne 0x434f34
mov dword [eax + 0x10], edx
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
mov edx, dword [esp + 0x1c]
test edx, edx
setne bl
mov ebp, dword [esp + 0x20]
test ebp, ebp
xchg ebp, ebx
setne bl
xchg ebp, ebx
or ebp, ebx
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x434b9f
mov dword [eax + 0x1c], 0xffffffff
mov dword [eax + 0x20], 0xffffffff
mov ebx, dword [0x728500]
lea ebp, [eax + 0x34]
test ebx, ebx
jne 0x434ef8
mov ebx, dword [esp + 0xc4]
mov dword [eax + 0x34], ebx
mov ebp, dword [esp + 0xac]
test byte [ebp], al
mov edx, dword [0x728500]
test edx, edx
jne 0x434ec7
mov dword [ebp], eax
movzx edx, word [edi + esi + 0xc]
cmp dx, 1
jne 0x434d5d
test byte [ebx], al
mov edx, dword [0x728500]
lea ebp, [eax + 8]
test edx, edx
jne 0x434d2c
mov dword [eax + 8], 0
lea edx, [ebx + 0x20]
test byte [edx], al
mov edx, dword [ebx + 0x24]
lea ebp, [ebx + 0x24]
mov dword [esp + 0xe4], ebp
test edx, edx
je 0x434ca5
mov esi, dword [0x728500]
lea ebp, [eax + 0xc]
lea ecx, [edx + 8]
test esi, esi
jne 0x434c4e
mov dword [eax + 0xc], edx
mov dword [edx + 8], eax
mov dword [ebx + 0x24], eax
lea edx, [eax + 0x2c]
mov eax, edi
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x54]
mov esi, dword [esp + 0xe8]
mov edi, dword [esp + 0x2c]
jmp 0x434aa4
mov dword [esp + 0xe0], ecx
mov dword [esp], ebp
mov dword [esp + 4], edx
call fcn.0040ec50
mov eax, dword [esp + 0xe0]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov edi, dword [esp + 0x9c]
jmp 0x434c31
mov edx, dword [0x728500]
lea esi, [eax + 0xc]
lea ebp, [ebx + 0x20]
test edx, edx
jne 0x434cc7
mov dword [eax + 0xc], 0
mov dword [ebx + 0x20], eax
mov dword [ebx + 0x24], eax
jmp 0x434c31
mov dword [esp + 0xe0], ebp
mov dword [esp], esi
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xe0]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb4]
mov edi, dword [esp + 0x9c]
jmp 0x434c31
mov dword [esp], ebp
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb4]
mov ebx, dword [esp + 0xc4]
mov edi, dword [esp + 0x9c]
jmp 0x434bfe
cmp dx, 2
jne 0x434c31
test byte [ebx], al
mov edx, dword [0x728500]
lea ebp, [eax + 8]
test edx, edx
jne 0x434e96
mov dword [eax + 8], 0
lea edx, [ebx + 0x28]
test byte [edx], al
mov edx, dword [ebx + 0x2c]
lea ebp, [ebx + 0x2c]
mov dword [esp + 0xe4], ebp
test edx, edx
je 0x434e0f
mov esi, dword [0x728500]
lea ebp, [eax + 0xc]
lea ecx, [edx + 8]
test esi, esi
jne 0x434db5
mov dword [eax + 0xc], edx
mov dword [edx + 8], eax
mov dword [ebx + 0x2c], eax
jmp 0x434c31
mov dword [esp + 0xe0], ecx
mov dword [esp], ebp
mov dword [esp + 4], edx
call fcn.0040ec50
mov eax, dword [esp + 0xe0]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov edi, dword [esp + 0x9c]
jmp 0x434c31
mov edx, dword [0x728500]
lea esi, [eax + 0xc]
lea ebp, [ebx + 0x28]
test edx, edx
jne 0x434e31
mov dword [eax + 0xc], 0
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
jmp 0x434c31
mov dword [esp + 0xe0], ebp
mov dword [esp], esi
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xe0]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb4]
mov edi, dword [esp + 0x9c]
jmp 0x434c31
mov dword [esp], ebp
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb4]
mov ebx, dword [esp + 0xc4]
mov edi, dword [esp + 0x9c]
jmp 0x434d81
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb4]
mov ebx, dword [esp + 0xc4]
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x9c]
jmp 0x434bd5
mov dword [esp], ebp
mov eax, dword [esp + 0xc4]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0x1c]
mov ebx, dword [esp + 0xc4]
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x9c]
jmp 0x434bba
mov dword [esp], ebp
mov dword [esp + 4], edx
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb4]
mov esi, dword [esp + 0x58]
mov edi, dword [esp + 0x9c]
jmp 0x434b65
mov dword [esp + 0xdc], edx
mov dword [esp], eax
mov ecx, dword [esp + 0xb4]
mov dword [esp + 4], ecx
call fcn.0040ec50
mov eax, dword [esp + 0xdc]
mov dword [esp], eax
lea eax, [esp + 0x4c]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0xb4]
lea edx, [esp + 0x4c]
jmp 0x434b43
mov edx, dword [0x728500]
lea ebp, [eax + 0x44]
mov dword [esp + 0xd8], ebp
test edx, edx
jne 0x435898
mov dword [eax + 0x44], 0
lea eax, [0x60936c]
mov dword [esp], eax
mov dword [esp + 4], 0
lea ecx, [0x5f6e70]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 6
mov byte [esp + 0x10], 0x18
mov dword [esp + 0x14], 1
call fcn.00428670
lea edi, [esp + 0x118]
xor eax, eax
call fcn.0044bde9
lea ecx, [0x4499b0]
mov dword [esp + 0x118], ecx
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x11c], edx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x120], ebx
mov ebp, dword [esp + 0x60]
mov dword [esp + 0x124], ebp
mov esi, dword [esp + 0xb0]
mov dword [esp + 0x128], esi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x12c], edi
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x130], ecx
lea eax, [esp + 0x118]
mov dword [esp], eax
call fcn.0044a0b0
mov eax, dword [esp + 0xb4]
mov ecx, dword [eax + 0x44]
mov dword [esp + 0xd4], ecx
mov edx, dword [0x728500]
test edx, edx
jne 0x43586e
mov dword [eax + 0x44], 0
mov edx, dword [eax + 0xb4]
mov dword [esp + 0x94], edx
mov ebx, edx
jmp 0x4350ad
mov edx, dword [edx + 0x2c]
mov ecx, dword [esp + 0xd4]
test edx, edx
je 0x43514c
mov ebp, dword [0x728500]
lea esi, [edx + 4]
lea edi, [edx + 0x10]
lea ecx, [edx + 0x34]
test ebp, ebp
jne 0x4350df
mov dword [edx + 4], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x34], 0
jmp 0x4350a3
mov dword [esp + 0xd0], edx
mov dword [esp + 0xd8], edi
mov dword [esp + 0xcc], ecx
mov dword [esp], esi
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xd8]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xcc]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0xd0]
mov ebx, dword [esp + 0x94]
jmp 0x4350a3
mov edx, dword [0x728500]
test edx, edx
jne 0x435844
mov dword [eax + 0xb4], 0
xor eax, eax
mov edx, dword [esp + 0xb0]
xor ebp, ebp
mov esi, 0xffffffff
jmp 0x435187
add edx, 2
mov edi, dword [esp + 0x54]
inc edi
mov ecx, dword [esp + 0xd4]
mov eax, edi
mov dword [esp + 0x50], esi
mov dword [esp + 0xb8], ebp
mov edi, dword [esp + 0x2c]
cmp eax, edi
jge 0x4357db
movzx ecx, word [edx]
mov edi, dword [esp + 0x24]
cmp ecx, edi
jae 0x435958
mov dword [esp + 0x58], ecx
mov dword [esp + 0x54], eax
imul ecx, ecx, 0x1c
mov edi, dword [esp + 0x9c]
lea eax, [ecx + edi]
mov dword [esp + 0xf0], eax
movzx eax, word [edi + ecx + 0xc]
test ax, ax
je 0x435176
mov dword [esp + 0xe8], edx
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
test edx, edx
xchg ebp, ebx
sete bl
xchg ebp, ebx
test eax, eax
xchg esi, ebx
seta bl
xchg esi, ebx
and esi, ebp
test edx, edx
xchg ebp, ebx
setg bl
xchg ebp, ebx
or ebp, esi
xchg ebp, eax
test al, al
xchg ebp, eax
je 0x43520d
mov dword [edi + ecx + 0x14], eax
mov dword [edi + ecx + 0x18], edx
mov dword [esp + 0x88], ebx
mov eax, dword [esp + 0xd4]
cmp ebx, eax
jne 0x435299
mov ecx, dword [esp + 0xf0]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x50], edx
mov dword [esp + 0xb8], ecx
mov ebp, dword [ebx + 0x2c]
mov dword [esp + 0x90], ebp
mov esi, dword [0x728500]
lea eax, [ebx + 0x2c]
test esi, esi
jne 0x435280
mov dword [ebx + 0x2c], 0
mov dword [esp], ebx
call fcn.00428c30
mov edx, dword [esp + 0xe8]
mov edi, dword [esp + 0x9c]
mov ebx, dword [esp + 0x90]
mov ebp, dword [esp + 0xb8]
mov esi, dword [esp + 0x50]
jmp 0x435176
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ebx, dword [esp + 0x88]
jmp 0x435253
mov edx, dword [edi + ecx + 4]
mov dword [esp + 0xc4], edx
movzx ecx, word [edi + ecx + 0xc]
cmp cx, 2
jne 0x435550
test byte [edx], al
lea ecx, [edx + 0x28]
mov dword [esp + 0xa0], ecx
mov ebp, dword [ebx + 0xc]
lea esi, [ebx + 0xc]
mov dword [esp + 0xec], esi
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
mov dword [esp + 0xe4], esi
test ebp, ebp
je 0x435439
mov dword [esp + 0x84], ebp
test eax, eax
je 0x435399
mov ecx, dword [0x728500]
lea edx, [ebp + 8]
lea esi, [eax + 0xc]
test ecx, ecx
jne 0x43532b
mov dword [ebp + 8], eax
mov dword [eax + 0xc], ebp
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov eax, dword [esp + 0xd4]
mov ecx, dword [esp + 0xb8]
mov edx, dword [esp + 0x50]
jmp 0x43522a
mov dword [esp + 0xe0], esi
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe0]
mov dword [esp], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xec]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ebx, dword [esp + 0x88]
mov edi, dword [esp + 0x9c]
jmp 0x435314
mov eax, dword [0x728500]
lea esi, [ebp + 8]
test eax, eax
jne 0x435401
mov dword [ebp + 8], 0
test byte [ecx], al
mov eax, dword [0x728500]
lea ecx, [edx + 0x2c]
test eax, eax
jne 0x4353cb
mov dword [edx + 0x2c], ebp
mov dword [ebx + 0xc], 0
jmp 0x435314
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.0040ec50
mov eax, dword [esp + 0xec]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ebx, dword [esp + 0x88]
mov edi, dword [esp + 0x9c]
jmp 0x435314
mov dword [esp], esi
mov dword [esp + 4], 0
call fcn.0040ec50
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0xc4]
mov ebx, dword [esp + 0x88]
mov ebp, dword [esp + 0x84]
mov edi, dword [esp + 0x9c]
jmp 0x4353ad
test eax, eax
je 0x4354df
mov ebp, dword [0x728500]
lea edi, [eax + 0xc]
test ebp, ebp
jne 0x4354a6
mov dword [eax + 0xc], 0
test byte [ecx], al
mov ecx, dword [0x728500]
lea ebp, [edx + 0x28]
test ecx, ecx
jne 0x43547a
mov dword [edx + 0x28], eax
mov dword [ebx + 8], 0
mov edi, dword [esp + 0x9c]
jmp 0x435314
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ebx, dword [esp + 0x88]
jmp 0x43546e
mov dword [esp + 0x7c], eax
mov dword [esp], edi
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0xc4]
mov ebx, dword [esp + 0x88]
mov esi, dword [esp + 0xe4]
jmp 0x435455
test byte [ecx], al
mov eax, dword [edx + 0x28]
lea ecx, [edx + 0x28]
cmp ebx, eax
jne 0x435314
mov eax, dword [0x728500]
lea ebp, [edx + 0x2c]
test eax, eax
jne 0x43550f
mov dword [edx + 0x28], 0
mov dword [edx + 0x2c], 0
jmp 0x435314
mov dword [esp + 0xec], ebp
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xec]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ebx, dword [esp + 0x88]
mov edi, dword [esp + 0x9c]
jmp 0x435314
test byte [edx], al
lea ecx, [edx + 0x20]
mov dword [esp + 0xa4], ecx
mov ebp, dword [ebx + 0xc]
lea esi, [ebx + 0xc]
mov dword [esp + 0xec], esi
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
mov dword [esp + 0xe4], esi
test ebp, ebp
je 0x4356c4
mov dword [esp + 0x80], ebp
test eax, eax
je 0x435624
mov ecx, dword [0x728500]
lea edx, [ebp + 8]
lea esi, [eax + 0xc]
test ecx, ecx
jne 0x4355b6
mov dword [ebp + 8], eax
mov dword [eax + 0xc], ebp
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
jmp 0x435314
mov dword [esp + 0xe0], esi
mov dword [esp], edx
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe0]
mov dword [esp], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xec]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ebx, dword [esp + 0x88]
mov edi, dword [esp + 0x9c]
jmp 0x435314
mov eax, dword [0x728500]
lea esi, [ebp + 8]
test eax, eax
jne 0x43568c
mov dword [ebp + 8], 0
test byte [ecx], al
mov eax, dword [0x728500]
lea ecx, [edx + 0x24]
test eax, eax
jne 0x435656
mov dword [edx + 0x24], ebp
mov dword [ebx + 0xc], 0
jmp 0x435314
mov dword [esp], ecx
mov dword [esp + 4], ebp
call fcn.0040ec50
mov eax, dword [esp + 0xec]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ebx, dword [esp + 0x88]
mov edi, dword [esp + 0x9c]
jmp 0x435314
mov dword [esp], esi
mov dword [esp + 4], 0
call fcn.0040ec50
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0xc4]
mov ebx, dword [esp + 0x88]
mov ebp, dword [esp + 0x80]
mov edi, dword [esp + 0x9c]
jmp 0x435638
test eax, eax
je 0x43576a
mov ebp, dword [0x728500]
lea edi, [eax + 0xc]
test ebp, ebp
jne 0x435731
mov dword [eax + 0xc], 0
test byte [ecx], al
mov ecx, dword [0x728500]
lea ebp, [edx + 0x20]
test ecx, ecx
jne 0x435705
mov dword [edx + 0x20], eax
mov dword [ebx + 8], 0
mov edi, dword [esp + 0x9c]
jmp 0x435314
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.0040ec50
mov eax, dword [esp + 0xe4]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ebx, dword [esp + 0x88]
jmp 0x4356f9
mov dword [esp + 0x78], eax
mov dword [esp], edi
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0xa4]
mov edx, dword [esp + 0xc4]
mov ebx, dword [esp + 0x88]
mov esi, dword [esp + 0xe4]
jmp 0x4356e0
test byte [ecx], al
mov eax, dword [edx + 0x20]
lea ecx, [edx + 0x20]
cmp ebx, eax
jne 0x435314
mov eax, dword [0x728500]
lea ebp, [edx + 0x24]
test eax, eax
jne 0x43579a
mov dword [edx + 0x20], 0
mov dword [edx + 0x24], 0
jmp 0x435314
mov dword [esp + 0xec], ebp
mov dword [esp], ecx
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xec]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ebx, dword [esp + 0x88]
mov edi, dword [esp + 0x9c]
jmp 0x435314
test ebp, ebp
jne 0x4357ea
xor eax, eax
xor ecx, ecx
xor edx, edx
jmp 0x434568
movzx eax, word [ebp + 0xc]
cmp ax, 1
jne 0x4357fe
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4357fe
mov byte [eax], 1
mov eax, dword [esp + 0x9c]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
call fcn.00433f90
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x50]
jmp 0x43469e
mov eax, dword [esp + 0xec]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov ecx, dword [esp + 0xd4]
mov ebx, dword [esp + 0x94]
jmp 0x435164
mov eax, dword [esp + 0xd8]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.0040ec50
mov eax, dword [esp + 0xb4]
mov ecx, dword [esp + 0xd4]
jmp 0x435092
mov dword [esp], ebp
mov dword [esp + 4], 0
call fcn.0040ec50
jmp 0x434fc5
mov eax, dword [esp + 0x9c]
mov dword [esp], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
call fcn.00433f90
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x50]
jmp 0x43469e
call fcn.0044b600
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x9c]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x170]
xor esi, esi
jmp 0x435931
mov edi, esi
imul esi, esi, 0x1c
mov dword [edx + esi + 0x14], 0xffffffff
mov dword [edx + esi + 0x18], 0xffffffff
lea esi, [edi + 1]
movzx edi, word [ebp + 2]
cmp esi, edi
jge 0x435942
cmp esi, ebx
jb 0x435919
jmp 0x435a3b
mov ebp, edx
mov edx, eax
mov esi, ecx
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x170]
jmp 0x434172
call fcn.00425900
ud2
call fcn.00425900
ud2
lea eax, [0x5f995b]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00426ea0
ud2
mov dword [esp], esi
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
call fcn.00433f90
lea eax, [0x5c87e0]
mov dword [esp], eax
lea eax, [0x625598]
mov dword [esp + 4], eax
call fcn.00426730
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.00425900
ud2
call fcn.004259c0
ud2
call fcn.00425900
ud2
lea eax, [0x5fe210]
mov dword [esp], eax
mov dword [esp + 4], 0x1d
call fcn.00426ea0
ud2
call fcn.0044a1d0
jmp fcn.004340b0