Function at 0x444130
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x676873
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
push ebx
push esi
push edi
mov eax, dword [0x702ca8]
xor eax, esp
push eax
lea eax, [esp + 0xf8]
mov dword fs:[0], eax
mov edi, ecx
fldz
xor ebx, ebx
mov dword [edi], 0x6c407c
fst dword [edi + 4]
fst dword [edi + 8]
sub esp, 0x1c
fst dword [edi + 0xc]
mov ecx, esp
mov dword [esp + 0x40], esp
fstp dword [edi + 0x34]
mov byte [edi + 0x10], bl
mov byte [edi + 0x11], bl
mov byte [edi + 0x12], bl
mov byte [edi + 0x13], bl
mov byte [edi + 0x14], bl
mov byte [edi + 0x15], bl
mov byte [edi + 0x16], bl
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov byte [edi + 0x38], bl
mov byte [edi + 0x39], bl
mov byte [edi + 0x3a], bl
mov byte [edi + 0x3b], bl
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x118], ebx
push 0xb
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c1a00
mov byte [ecx + 4], bl
call fcn.004027b0
lea eax, [esp + 0x58]
push eax
call fcn.00488db0
add esp, 0x20
mov dword [esp + 0x100], ebx
cmp dword [eax + 0x18], 0x10
jb 0x4441fe
mov eax, dword [eax + 4]
jmp 0x444201
add eax, 4
push eax
push 0x6c1ffc
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x48], esp
push 8
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6ba1c0
mov byte [ecx + 4], bl
call fcn.004027b0
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x10]
push edx
call fcn.0045bb10
add esp, 0x28
mov dword [esp + 0x100], 0xffffffff
cmp dword [esp + 0x54], 0x10
jb 0x444256
mov eax, dword [esp + 0x40]
push eax
call fcn.0060445c
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
mov dword [edi + 0x18], 0x320
mov dword [edi + 0x1c], 0x258
mov dword [edi + 0x20], 0xffffffff
push 0xb
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2018
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 1
mov dword [esp + 0x58], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x444335
mov edx, dword [edi + 0x20]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xb
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2018
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 2
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
push ecx
mov dword [esp + 0x140], 0xffffffff
call fcn.00466250
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xb
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2018
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 3
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x6c]
call fcn.00465c60
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], 0xffffffff
push 0xc
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2024
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 4
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x44446a
mov ecx, dword [edi + 0x24]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xc
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2024
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 5
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov edx, dword [0x717c9c]
mov eax, dword [edx + 0x6c]
push eax
mov dword [esp + 0x140], 0xffffffff
call fcn.00466250
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0xc
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2024
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 6
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.00465c60
fld dword [0x6ddb00]
sub esp, 0x1c
fstp dword [edi + 4]
mov ecx, esp
mov dword [esp + 0x3c], esp
mov dword [edi + 0x24], eax
push 0x10
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2034
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 7
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x4445a4
fld dword [edi + 4]
sub esp, 0x24
mov ecx, esp
fstp qword [esp + 0x1c]
mov dword [esp + 0x44], esp
push 0x10
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2034
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x140], 8
mov dword [esp + 0x64], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
push ecx
mov dword [esp + 0x144], 0xffffffff
call fcn.004663d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x10
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2034
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 9
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x6c]
call fcn.00465da0
fstp dword [edi + 4]
fld dword [0x6ddc90]
sub esp, 0x1c
mov ecx, esp
fstp dword [edi + 8]
mov dword [esp + 0x3c], esp
push 0x10
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2048
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0xa
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x4446de
fld dword [edi + 8]
sub esp, 0x24
mov ecx, esp
fstp qword [esp + 0x1c]
mov dword [esp + 0x44], esp
push 0x10
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2048
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x140], 0xb
mov dword [esp + 0x64], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x6c]
push edx
mov dword [esp + 0x144], 0xffffffff
call fcn.004663d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x10
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c2048
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0xc
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
call fcn.00465da0
fstp dword [edi + 8]
fldz
sub esp, 0x1c
mov ecx, esp
fstp dword [edi + 0xc]
mov dword [esp + 0x3c], esp
push 0x10
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x6c205c
mov byte [ecx + 4], bl
call fcn.004027b0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0xd
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x444809
fld dword [edi + 0xc]
sub esp, 0x24
fstp qword [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x6c205c
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x140], 0xe
mov dword [esp + 0x64], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov edx, dword [0x717c9c]
mov eax, dword [edx + 0x6c]
push eax
mov dword [esp + 0x144], 0xffffffff
call fcn.004663d0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c205c
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], esi
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.00465da0
fstp dword [edi + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c2070
mov byte [edi + 0x10], 1
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x10
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x444918
movzx eax, byte [edi + 0x10]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c2070
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 0x11
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x6c]
push edx
mov dword [esp + 0x140], 0xffffffff
call fcn.00466550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c2070
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x12
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
call fcn.00465ef0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c207c
mov byte [edi + 0x10], al
mov byte [edi + 0x11], 1
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x13
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x444a29
movzx edx, byte [edi + 0x11]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c207c
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 0x14
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
push ecx
mov dword [esp + 0x140], 0xffffffff
call fcn.00466550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c207c
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x15
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x6c]
call fcn.00465ef0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c208c
mov byte [edi + 0x11], al
mov byte [edi + 0x14], bl
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x16
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x444b3a
movzx ecx, byte [edi + 0x14]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c208c
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 0x17
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov edx, dword [0x717c9c]
mov eax, dword [edx + 0x6c]
push eax
mov dword [esp + 0x140], 0xffffffff
call fcn.00466550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c208c
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x18
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.00465ef0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20a0
mov byte [edi + 0x14], al
mov byte [edi + 0x15], 1
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x19
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x444c4d
movzx eax, byte [edi + 0x15]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c20a0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 0x1a
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x6c]
push edx
mov dword [esp + 0x140], 0xffffffff
call fcn.00466550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20a0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x1b
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
call fcn.00465ef0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20b0
mov byte [edi + 0x15], al
mov byte [edi + 0x12], bl
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x1c
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x444d5d
movzx edx, byte [edi + 0x12]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c20b0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 0x1d
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
push ecx
mov dword [esp + 0x140], 0xffffffff
call fcn.00466550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20b0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x1e
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x6c]
call fcn.00465ef0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20bc
mov byte [edi + 0x12], al
mov byte [edi + 0x13], 1
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x1f
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x444e6f
movzx ecx, byte [edi + 0x13]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c20bc
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 0x20
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov edx, dword [0x717c9c]
mov eax, dword [edx + 0x6c]
push eax
mov dword [esp + 0x140], 0xffffffff
call fcn.00466550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20bc
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x21
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.00465ef0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20d0
mov byte [edi + 0x13], al
mov byte [edi + 0x38], bl
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x22
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x444f81
movzx eax, byte [edi + 0x38]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c20d0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 0x23
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x6c]
push edx
mov dword [esp + 0x140], 0xffffffff
call fcn.00466550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20d0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x24
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
call fcn.00465ef0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20e0
mov byte [edi + 0x38], al
mov byte [edi + 0x39], bl
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x25
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x445091
movzx edx, byte [edi + 0x39]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c20e0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 0x26
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
push ecx
mov dword [esp + 0x140], 0xffffffff
call fcn.00466550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20e0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x27
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov edx, dword [0x717c9c]
mov ecx, dword [edx + 0x6c]
call fcn.00465ef0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20f0
mov byte [edi + 0x39], al
mov byte [edi + 0x16], 1
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x28
mov dword [esp + 0x5c], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], 0xffffffff
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x6c]
call fcn.004652c0
cmp al, bl
jne 0x4451a3
movzx ecx, byte [edi + 0x16]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c20f0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x13c], 0x29
mov dword [esp + 0x60], esp
push 0xffffffffffffffff
push ebx
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov edx, dword [0x717c9c]
mov eax, dword [edx + 0x6c]
push eax
mov dword [esp + 0x140], 0xffffffff
call fcn.00466550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c20f0
call fcn.00402ee0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], 0x2a
mov dword [ecx + 0x18], esi
mov dword [esp + 0x5c], esp
or esi, 0xffffffff
push esi
push ebx
mov dword [ecx + 0x14], ebx
push 0x718184
mov byte [ecx + 4], bl
call fcn.00402610
mov dword [esp + 0x138], esi
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x6c]
call fcn.00465ef0
fild dword [edi + 0x1c]
push 0x78
mov byte [edi + 0x16], al
fidiv dword [edi + 0x18]
fstp dword [edi + 0x34]
call sub.d3d8.dll_Direct3DCreate8
cmp eax, ebx
mov dword [edi + 0x40], eax
jne 0x4452a5
push 0x4a
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c210c
call fcn.00402ee0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x14]
lea edx, [esp + 0x78]
push edx
call fcn.00443d60
mov esi, 0x10
mov dword [esp + 0x104], 0x2b
cmp dword [eax + 0x18], esi
jb 0x445256
mov eax, dword [eax + 4]
jmp 0x445259
add eax, 4
push eax
push 0x6c1ffc
push 0x6c2128
lea ecx, [esp + 0x4c]
call fcn.00402ee0
mov byte [esp + 0x10c], 0x2c
cmp dword [eax + 0x18], esi
jb 0x44527f
mov eax, dword [eax + 4]
jmp 0x445282
add eax, 4
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x6ba1d0
call fcn.00402ee0
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x14]
push edx
call fcn.00443a50
mov ecx, dword [eax]
lea edx, [edi + 0x44]
push edx
xor edx, edx
cmp byte [edi + 0x14], bl
setne dl
add edx, 1
push edx
push ebx
push eax
mov eax, dword [ecx + 0x34]
call eax
test eax, eax
jge 0x445356
push 0x50
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c210c
call fcn.00402ee0
mov edx, dword [0x717c9c]
lea ecx, [esp + 0x78]
push ecx
mov ecx, dword [edx + 0x14]
call fcn.00443d60
mov esi, 0x10
mov dword [esp + 0x104], 0x2d
cmp dword [eax + 0x18], esi
jb 0x445308
mov eax, dword [eax + 4]
jmp 0x44530b
add eax, 4
push eax
push 0x6c1ffc
push 0x6c2180
lea ecx, [esp + 0x4c]
call fcn.00402ee0
mov byte [esp + 0x10c], 0x2e
cmp dword [eax + 0x18], esi
jb 0x445331
mov eax, dword [eax + 4]
jmp 0x445334
add eax, 4
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x6ba1d0
call fcn.00402ee0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x14]
push ecx
call fcn.00443a50
push edi
call fcn.00446440
call fcn.00446c10
cmp byte [edi + 0x15], bl
je 0x4453aa
test dword [edi + 0x60], 0x10000
je 0x4453aa
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c21cc
mov byte [esp + 0x4b], 1
call fcn.00402ee0
lea edx, [esp + 0x58]
push edx
call fcn.00488db0
add esp, 0x20
mov dword [esp + 0x100], 0x2f
cmp dword [eax + 0x18], 0x10
jb 0x4453e4
mov eax, dword [eax + 4]
jmp 0x4453e7
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c21e0
mov byte [esp + 0x4b], bl
call fcn.00402ee0
lea edx, [esp + 0x58]
push edx
call fcn.00488db0
add esp, 0x20
mov dword [esp + 0x100], 0x30
cmp dword [eax + 0x18], 0x10
jb 0x4453e4
mov eax, dword [eax + 4]
jmp 0x4453e7
add eax, 4
push eax
push 0x6c1ffc
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x6ba1c0
call fcn.00402ee0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.0045bb10
add esp, 0x28
lea ecx, [esp + 0x3c]
mov dword [esp + 0x100], esi
call fcn.00402590
mov eax, dword [edi + 0x40]
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov edx, dword [eax]
mov edx, dword [edx + 0x20]
push ebx
push eax
call edx
mov esi, eax
cmp esi, ebx
jge 0x4454dc
push 0x61
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c210c
call fcn.00402ee0
mov ecx, dword [0x717c9c]
mov ecx, dword [ecx + 0x14]
lea eax, [esp + 0x78]
push eax
call fcn.00443d60
mov dword [esp + 0x104], 0x31
cmp dword [eax + 0x18], 0x10
jb 0x44548a
mov eax, dword [eax + 4]
jmp 0x44548d
add eax, 4
push eax
push 0x6c1ffc
mov eax, esi
push 0x6c2210
lea esi, [esp + 0x4c]
call fcn.00443cf0
mov byte [esp + 0x110], 0x32
cmp dword [eax + 0x18], 0x10
jb 0x4454b6
mov eax, dword [eax + 4]
jmp 0x4454b9
add eax, 4
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x6ba0c0
call fcn.00402ee0
mov edx, dword [0x717c9c]
mov eax, dword [edx + 0x14]
push eax
call fcn.00443a50
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push ecx
lea esi, [esp + 0x5c]
call fcn.0044ad20
mov esi, 0x10
mov dword [esp + 0x104], 0x33
cmp dword [eax + 0x18], esi
jb 0x445508
mov eax, dword [eax + 4]
jmp 0x44550b
add eax, 4
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push edx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
push 0x6c2254
call fcn.00402ee0
lea ecx, [esp + 0x68]
push ecx
call fcn.00488db0
add esp, 0x30
mov byte [esp + 0x100], 0x34
cmp dword [eax + 0x18], esi
jb 0x445548
mov eax, dword [eax + 4]
jmp 0x44554b
add eax, 4
push eax
push 0x6c1ffc
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x6ba1c0
call fcn.00402ee0
mov edx, dword [0x717c9c]
mov eax, dword [edx + 0x10]
push eax
call fcn.0045bb10
add esp, 0x28
lea ecx, [esp + 0x3c]
call fcn.00402590
lea ecx, [esp + 0x58]
mov dword [esp + 0x100], 0xffffffff
call fcn.00402590
cmp dword [edi + 0x20], ebx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x118], edx
jge 0x4455b3
mov dword [edi + 0x20], eax
cmp dword [edi + 0x24], ebx
jge 0x4455bb
mov dword [edi + 0x24], ecx
push ebx
lea esi, [edi + 0x11c]
push esi
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test eax, eax
jne 0x4455ea
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x2c]
mov dword [esi], ebx
mov dword [edi + 0x120], ebx
mov dword [edi + 0x124], eax
mov dword [edi + 0x128], ecx
lea esi, [esp + 0x90]
call fcn.0044b4b0
lea esi, [edi + 0x3c]
push esi
lea eax, [esp + 0x94]
push eax
mov al, byte [esp + 0x33]
neg al
mov ecx, dword [edi + 0x40]
mov edx, dword [ecx]
sbb eax, eax
and eax, 0x20
add eax, 0x20
push eax
mov eax, dword [0x717c9c]
mov eax, dword [eax + 0xc]
push eax
xor eax, eax
cmp byte [edi + 0x14], bl
setne al
add eax, 1
push eax
push ebx
push ecx
mov ecx, dword [edx + 0x3c]
call ecx
cmp eax, ebx
mov dword [esp + 0x24], eax
jge 0x4456d5
push 0x85
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c210c
call fcn.00402ee0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x14]
lea edx, [esp + 0x78]
push edx
call fcn.00443d60
mov edi, 0x10
mov dword [esp + 0x104], 0x35
cmp dword [eax + 0x18], edi
jb 0x445682
mov eax, dword [eax + 4]
jmp 0x445685
add eax, 4
push eax
mov eax, dword [esp + 0x2c]
push 0x6c1ffc
push 0x6c2280
lea esi, [esp + 0x4c]
call fcn.00443cf0
mov byte [esp + 0x110], 0x36
cmp dword [eax + 0x18], edi
jb 0x4456af
mov eax, dword [eax + 4]
jmp 0x4456b2
add eax, 4
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x6ba0c0
call fcn.00402ee0
mov ecx, dword [0x717c9c]
mov edx, dword [ecx + 0x14]
push edx
call fcn.00443a50
mov esi, dword [esi]
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
push esi
call ecx
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x6c2358
call fcn.00402ee0
lea edx, [esp + 0x78]
push edx
call fcn.00488db0
add esp, 0x24
mov esi, 0x10
mov dword [esp + 0x100], 0x37
cmp dword [eax + 0x18], esi
jb 0x44571a
mov eax, dword [eax + 4]
jmp 0x44571d
add eax, 4
push eax
push 0x6c1ffc
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x6ba1c0
call fcn.00402ee0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.0045bb10
add esp, 0x28
lea ecx, [esp + 0x58]
mov dword [esp + 0x100], 0xffffffff
call fcn.00402590
mov edx, edi
call fcn.0044b440
push ebx
push edi
call fcn.0044b550
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x6c0df0
call fcn.00402ee0
lea edx, [esp + 0x90]
push edx
call fcn.00488db0
add esp, 0x20
mov dword [esp + 0x100], 0x38
cmp dword [eax + 0x18], esi
jb 0x4457a1
mov eax, dword [eax + 4]
jmp 0x4457a4
add eax, 4
push eax
push 0x6c1ffc
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x44], esp
push 0x6ba1c0
call fcn.00402ee0
mov eax, dword [0x717c9c]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.0045bb10
add esp, 0x28
lea ecx, [esp + 0x74]
call fcn.00402590
mov eax, edi
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret