Function at 0x406040
Capabilities:
Encrypt data using speck
Log keystrokes via polling

Disassembly:
sub esp, 0x120
mov eax, dword [esp + 0x138]
mov dword [esp + 0x24], edx
push ebx
push ebp
push esi
mov esi, ecx
mov ecx, 0x3fff
mov dword [esp + 0x24], esi
mov dword [esp + 0x48], ecx
push edi
mov edi, dword [esp + 0x140]
movzx ebp, di
cmp eax, 0xffc3d44f
je 0x406088
cmp eax, 0xffc3d44e
je 0x406088
mov byte [esp + 0x23], 0
cmp eax, 0xffc3d44d
jne 0x40608d
mov byte [esp + 0x23], 1
mov ecx, dword [0x4d1694]
mov ebx, dword [esp + 0x13c]
test ecx, ecx
jne 0x4060ab
lea edx, [esp + 0x5c]
mov dword [esp + 0x1c], edx
jmp 0x40616a
mov eax, dword [0x4d16d0]
imul esi, eax, 0xd4
inc eax
add esi, ecx
xor ecx, ecx
cmp eax, dword [0x4ce8cc]
mov dword [esp + 0x1c], esi
cmovge eax, ecx
mov dword [0x4d16d0], eax
mov eax, dword [esp + 0x144]
mov byte [esi], bl
mov byte [esi + 6], al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov dword [0x4d16cc], eax
sub ecx, dword [0x4d4b78]
mov dword [0x4d4b78], eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x4c96f0]
cvtpd2ps xmm0, xmm0
divss xmm0, dword [0x4c9624]
movss dword [esi + 8], xmm0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [esp + 0x1c]
mov esi, eax
lea ecx, [edx + 0xc]
test esi, esi
je 0x406151
cmp esi, dword [0x4d16c8]
je 0x40614a
push esi
push ecx
push 0x418
push dword [0x4d1684]
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [esp + 0x1c]
jmp 0x406160
xor eax, eax
mov word [ecx], ax
jmp 0x406160
mov eax, dword [0x4beecc]
mov dword [ecx], eax
mov eax, dword [0x4beed0]
mov dword [ecx + 4], eax
mov dword [0x4d16c8], esi
mov esi, dword [esp + 0x28]
cmp bl, 0xe7
jne 0x4061a4
mov ecx, dword [esp + 0x138]
mov edi, 0x55
push 0
push 0x3fff
push edx
movzx eax, word [ecx + 4]
push dword [esp + 0x150]
mov word [edx + 2], ax
push eax
push 0xe7
push ecx
mov word [edx + 4], di
mov ecx, esi
jmp 0x4066ca
mov al, bl
mov word [edx + 2], di
add al, 0x64
mov cl, 3
cmp cl, al
sbb eax, eax
and eax, ebp
movzx ebp, ax
mov dword [esp + 0x14], ebp
cmp esi, dword [0x4d169c]
jne 0x4061f7
mov cl, byte [esp + 0x14c]
mov edx, dword [esp + 0x144]
and cl, 1
mov dword [esp + 0x2c], ecx
jne 0x406383
movzx ecx, bl
mov al, dl
xor al, 1
shl al, 7
mov byte [ecx + 0x4d2018], al
mov ecx, dword [esp + 0x2c]
jmp 0x406383
mov edi, dword [esp + 0x14c]
mov ecx, edi
shr ecx, 4
and ecx, 0xffffff01
mov dword [esp + 0x2c], ecx
test ebp, 0x100
jne 0x406322
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je case.default.0x406242
movzx eax, bl
add eax, 0xfffffff4
cmp eax, 0x62
ja case.default.0x406242
movzx eax, byte [eax + 0x407de0]
jmp dword [eax*4 + 0x407db0]
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bc8], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bc9], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bca], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bcb], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bcc], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bcd], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bce], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bcf], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bd0], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bd1], al
jmp 0x406332
mov edx, dword [esp + 0x144]
mov al, dl
xor al, 1
mov byte [0x4d4bd2], al
jmp 0x406332
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x144]
jmp 0x406336
mov edx, dword [esp + 0x144]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [0x4d4bb4]
movzx esi, bl
lea eax, [esi + esi*8]
shl eax, 5
cmp byte [eax + ebp + 4], 0
jne 0x40637b
push edx
mov dl, bl
mov ecx, edi
call fcn.004092d0
mov edx, dword [esp + 0x148]
add esp, 4
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x14]
test al, al
je 0x40637f
mov al, dl
xor al, 1
shl al, 7
mov byte [esi + 0x4d2018], al
jmp 0x40637f
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x28]
cmp byte [esp + 0x23], 0
je 0x406391
mov eax, 0x69
jmp 0x4063a3
test cl, cl
mov eax, 0x20
mov edi, 0x61
cmovne eax, edi
movzx eax, ax
cmp byte [0x4d2014], 0
mov ecx, dword [esp + 0x1c]
lea edi, [ecx + 4]
mov word [edi], ax
mov dword [esp + 0x50], edi
je 0x4063f5
cmp bl, 0x5b
je 0x4063c4
cmp bl, 0x5c
jne 0x4063f5
test dl, dl
jne 0x4063f5
mov edx, dword [esp + 0x138]
push 0
push SysReAllocString
push 0x3fff
push ecx
push 0
push ebp
push ebx
mov ecx, esi
call fcn.00407ed0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
cmp byte [0x4d4ba0], 0
mov ebp, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
je 0x4064b0
cmp bl, 0x1b
jne 0x4064b0
test dl, dl
jne 0x4064b0
push 0
push str.32771
call edi
test eax, eax
je 0x4064b0
push 0
push eax
call ebp
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
jne 0x4064b0
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
xor ecx, ecx
call fcn.0040f910
mov dl, byte [0x4d2017]
mov ecx, 1
push 0xffc3d44d
shr dl, 3
push 0
and dl, 1
push 0
push 0
or dl, 0xa4
call fcn.0040f910
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0x158]
mov ecx, dword [esp + 0x48]
push 0
push SysReAllocString
push 0x3fff
push dword [esp + 0x48]
push 0
push edi
push 0x1b
call fcn.00407ed0
add esp, 0x3c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
mov edx, dword [esp + 0x14]
mov esi, dword [0x4d4bb8]
movzx eax, dx
mov dword [esp + 0x44], eax
lea ecx, [eax + eax*8]
mov eax, dword [esp + 0x28]
shl ecx, 5
add esi, ecx
mov cl, byte [esi + 0x12]
mov byte [esp + 0x3b], cl
cmp eax, dword [0x4d16a0]
jne 0x4064e0
test cl, cl
jne 0x4064f3
movzx eax, bl
lea esi, [eax + eax*8]
mov eax, dword [esp + 0x28]
shl esi, 5
add esi, dword [0x4d4bb4]
cmp byte [esp + 0x23], 0
je 0x40653d
cmp dword [esp + 0x148], 0xffc3d44e
mov eax, dword [esp + 0x144]
jne 0x40652c
test al, al
je 0x40652c
cmp dword [0x4d4ba4], esi
jne 0x40652c
mov byte [esi + 0xc], 0
mov byte [esi + 0xf], 0
mov dword [0x4d4ba4], 0
push 0
push 0x3fff
push dword [esp + 0x24]
push eax
jmp 0x4066bd
mov ecx, dword [esp + 0x144]
mov dword [esp + 0x58], 0x3fff
test cl, cl
jne 0x406563
mov ebx, 0x3fff
mov byte [esi + 0x10], cl
mov word [esi + 6], bx
mov ebx, dword [esp + 0x13c]
cmp eax, dword [0x4d16a0]
jne 0x406653
test cl, cl
je 0x406618
cmp byte [0x4d4b9c], 0
je 0x406585
cmp bl, 0x5b
je 0x4065af
cmp byte [0x4d4b9d], 0
je 0x406593
cmp bl, 0x5c
je 0x4065af
cmp byte [0x4d4b9e], 0
je 0x4065a1
cmp bl, 0xa4
je 0x4065af
cmp byte [0x4d4b9f], 0
je 0x406618
cmp bl, 0xa5
jne 0x406618
movzx eax, bl
add eax, 0xffffffa5
cmp eax, 0x4a
ja case.0x4065c1.93
movzx eax, byte [eax + 0x407e58]
jmp dword [eax*4 + 0x407e44]
mov byte [0x4d4b9c], 0
jmp case.0x4065c1.93
mov byte [0x4d4b9d], 0
jmp case.0x4065c1.93
mov byte [0x4d4b9e], 0
jmp case.0x4065c1.93
mov byte [0x4d4b9f], 0
test byte [0x4d2017], 3
jne 0x406618
mov dl, byte [0x4cfaa3]
mov ecx, 2
push 0xffc3d44d
push 0
push 0
push 0
call fcn.0040f910
add esp, 0x10
mov ecx, dword [esp + 0x144]
mov edx, dword [0x4d4ba4]
mov ebp, dword [esp + 0x28]
test edx, edx
je 0x4066fe
cmp edx, esi
je 0x4066fe
test cl, cl
jne 0x4066fe
cmp ebp, dword [0x4d16a0]
jne 0x4066e8
xor eax, eax
cmp byte [esi + 4], al
sete al
jmp 0x4066f1
test bl, bl
jne 0x40666a
push 0
push 0x3fff
push dword [esp + 0x24]
push ecx
push edx
push 0
mov ecx, eax
jmp 0x4066c3
cmp bl, 1
je 0x406674
cmp bl, 2
jne 0x406618
cmp dword [0x4d1450], 0
jne 0x4066a6
push 0
push str.32768
call edi
test eax, eax
je 0x406611
push 0
push eax
call ebp
mov ecx, dword [esp + 0x144]
cmp eax, dword [0x4d3e6c]
jne 0x406618
mov edx, dword [esp + 0x14]
push 0
push 0x3fff
push dword [esp + 0x24]
mov al, cl
mov byte [esi + 0xf], 0
xor al, 1
mov byte [esi + 0xc], al
push ecx
push edx
mov ecx, dword [esp + 0x3c]
push ebx
push dword [esp + 0x150]
push dword [esp + 0x150]
mov edx, dword [esp + 0x54]
call fcn.00408000
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
mov eax, dword [0x4d4ba4]
movzx eax, byte [eax + 4]
test eax, eax
je 0x4066fe
mov eax, dword [0x4d4ba4]
mov byte [eax + 0x11], 1
cmp byte [esi + 8], 0
jne 0x40671f
cmp byte [esi + 9], 0
jne 0x40671f
mov edi, dword [esp + 0x14]
push 0
push 0x3fff
push dword [esp + 0x24]
push ecx
push edi
mov ecx, ebp
jmp 0x4066c2
mov dword [esp + 0x24], 0x3fff
mov dword [esp + 0x40], 0
test cl, cl
je 0x40675d
mov dl, byte [esi + 0xf]
mov dh, byte [esi + 0xc]
movzx eax, word [esi + 6]
mov byte [esp + 0x11], dh
mov byte [esp + 0x33], dl
mov edx, 0x3fff
mov byte [esi + 0xf], 0
cmp ax, dx
je 0x40676d
mov dword [esp + 0x24], eax
mov word [esi + 6], dx
jmp 0x40676d
mov al, byte [esp + 0x11]
mov byte [esp + 0x11], al
mov al, byte [esp + 0x11]
mov byte [esp + 0x33], al
mov al, cl
mov byte [esp + 0x12], 0
xor al, 1
mov byte [esi + 0xc], al
cmp ebp, dword [0x4d16a0]
jne 0x4067f3
cmp byte [esi + 4], 0
je 0x406819
mov edx, dword [0x4d4bb4]
cmp byte [edx + 0xb64c], 0
jne 0x4067a7
cmp byte [edx + 0xb76c], 0
jne 0x4067a7
xor al, al
jmp 0x4067a9
mov al, 1
cmp byte [edx + 0xb88c], 0
mov byte [edx + 0x132c], al
jne 0x4067c5
cmp byte [edx + 0xb9ac], 0
jne 0x4067c5
xor al, al
jmp 0x4067c7
mov al, 1
cmp byte [edx + 0xb40c], 0
mov byte [edx + 0x144c], al
jne 0x4067e9
cmp byte [edx + 0xb52c], 0
jne 0x4067e9
xor al, al
mov byte [edx + 0x120c], al
jmp 0x406819
mov al, 1
mov byte [edx + 0x120c], al
jmp 0x406819
cmp dword [0x4d16a0], 0
jne 0x406819
mov cl, 1
call fcn.00411ce0
mov ecx, dword [esp + 0x144]
mov byte [0x4d2016], al
mov byte [0x4d2017], al
mov byte [esp + 0x12], 1
mov eax, dword [esi]
test eax, eax
je 0x406829
cmp dword [eax], 7
mov byte [esp + 0x23], 1
je 0x40682e
mov byte [esp + 0x23], 0
mov al, byte [esi + 8]
test al, al
je 0x4069cf
test cl, cl
jne 0x4069cf
mov edx, dword [0x4d4ba4]
test edx, edx
je 0x406858
cmp byte [esi + 9], cl
je 0x406858
cmp esi, edx
jne 0x4069cf
mov edi, dword [esp + 0x44]
cmp al, 1
jne 0x40687f
mov dl, byte [esp + 0x3b]
mov ecx, edi
test dl, dl
movzx eax, bl
cmove ecx, eax
call fcn.0040b770
test al, al
je 0x40687f
mov dl, 1
mov byte [esp + 0x1b], dl
jmp 0x406896
xor dl, dl
mov byte [esp + 0x1b], dl
cmp esi, dword [0x4d4ba4]
je 0x406896
mov dword [0x4d4ba4], esi
mov byte [esi + 0x11], dl
cmp byte [esi + 9], 0
je 0x406941
cmp byte [esp + 0x12], 0
jne 0x4068b3
mov cl, 1
mov byte [esp + 0x12], 1
call fcn.00411ce0
mov al, byte [esi + 4]
mov cl, byte [0x4d2016]
test al, al
je 0x4068c4
not al
and cl, al
mov dl, byte [esp + 0x1b]
test cl, cl
jne 0x4068d6
test dl, dl
jne 0x4068d6
test byte [esi + 0xb], 1
je 0x406941
cmp ebp, dword [0x4d16a0]
jne 0x4068f4
cmp byte [esp + 0x3b], 0
je 0x4068f4
mov eax, dword [0x4d4bac]
movzx ecx, cl
shl ecx, 9
add ecx, edi
jmp 0x406904
movzx ecx, cl
movzx eax, bl
shl ecx, 8
add ecx, eax
mov eax, dword [0x4d4ba8]
movzx eax, word [eax + ecx*2]
movzx edi, ax
mov dword [esp + 0x24], edi
test eax, 0x4000
je 0x406924
mov word [esi + 6], ax
mov dword [esp + 0x24], 0x3fff
jmp 0x406953
and eax, 0x3fff
cmp ax, word [0x4d30f4]
jae 0x406945
mov ecx, eax
mov eax, dword [0x4d4bb0]
mov ax, word [eax + ecx*2]
mov word [esi + 6], ax
mov edi, dword [esp + 0x24]
mov eax, 0x3fff
cmp di, ax
jne 0x4069d3
test dl, dl
je 0x406967
mov eax, dword [esp + 0x50]
mov ecx, 0x23
or byte [esi + 0xb], 8
mov word [eax], cx
cmp byte [esi + 4], 0
jne 0x4069b6
test byte [esi + 0xb], 1
jne 0x4069b6
cmp byte [esp + 0x23], 0
jne 0x4069b6
test dl, dl
jne 0x4069b6
push 0
push SysReAllocString
push 0x3fff
push dword [esp + 0x28]
mov byte [esi + 0x10], 1
push 0
mov ecx, ebp
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x14c]
push edi
push ebx
call fcn.00407ed0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
mov edi, dword [esp + 0x14]
mov ecx, ebp
push 0
push 0x3fff
push dword [esp + 0x24]
push 0
push edi
jmp 0x4066c2
mov edi, dword [esp + 0x24]
cmp byte [esi + 9], 0
mov eax, dword [esp + 0x144]
mov byte [esp + 0x1b], 0
je 0x406a58
test al, al
je 0x406a58
mov ch, byte [esp + 0x33]
cmp dword [0x4d4ba4], esi
jne 0x406a03
test ch, ch
je 0x406a58
mov dword [0x4d4ba4], 0
cmp byte [esi + 0xa], 0
jne 0x406a53
mov cl, byte [esi + 0xb]
test cl, 8
je 0x406a1b
xor dl, dl
and cl, 0xf7
mov byte [esi + 0xb], cl
jmp 0x406a1d
mov dl, 1
test ch, ch
je 0x406a3b
test dl, dl
je 0x406a3b
push 0
push SysReAllocString
push 0x3fff
push dword [esp + 0x28]
push eax
jmp 0x406994
mov edi, dword [esp + 0x14]
mov ecx, ebp
push 0
push 0x3fff
push dword [esp + 0x24]
push eax
push edi
jmp 0x4066c2
mov byte [esp + 0x1b], 1
cmp byte [esi + 8], 0
mov ecx, 1
je 0x406c41
test al, al
je 0x406c41
mov edx, dword [0x4d4ba4]
xor eax, eax
cmp edx, esi
cmove edx, eax
mov dword [0x4d4ba4], edx
cmp byte [esi + 0xd], al
je 0x406aa5
push 0xffc3d44d
push eax
push eax
push eax
mov dl, 0x12
mov byte [esi + 0xd], al
call fcn.0040f910
mov edi, dword [esp + 0x34]
add esp, 0x10
mov ecx, 1
cmp byte [esi + 0xe], 0
je 0x406ac8
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
mov byte [esi + 0xe], 0
call fcn.0040f910
mov edi, dword [esp + 0x34]
add esp, 0x10
mov edx, 0x3fff
cmp di, dx
jne 0x406afc
mov al, byte [esi + 0xb]
test al, 8
je 0x406afc
and al, 0xf7
mov byte [esi + 0xb], al
push 0
mov edi, dword [esp + 0x18]
mov ecx, ebp
push 0x3fff
push dword [esp + 0x24]
push dword [esp + 0x150]
push edi
jmp 0x4066c2
mov cl, byte [esp + 0x23]
mov al, byte [esi + 0x11]
test cl, cl
je 0x406bbe
cmp al, 2
jne 0x406b74
mov edi, dword [esp + 0x14]
mov dl, bl
push 0xffc3d44e
push 0
push 0
push edi
mov ecx, 1
call fcn.0040f910
push 0xffc3d44d
push 0
push 0
push edi
mov dl, bl
mov ecx, 2
call fcn.0040f910
mov edx, dword [esp + 0x158]
mov ecx, ebp
push 0
push SysReAllocString
push 0x3fff
push dword [esp + 0x48]
push dword [esp + 0x174]
push edi
push ebx
call fcn.00407ed0
add esp, 0x3c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
cmp al, 1
je 0x406ade
cmp byte [esi + 9], 0
jne 0x406c30
cmp byte [esi + 4], 0
jne 0x406ade
test byte [esi + 0xb], 1
jne 0x406ade
test cl, cl
jne 0x406ade
push 0
push SysReAllocString
push 0x3fff
push dword [esp + 0x28]
push dword [esp + 0x154]
jmp 0x406994
test al, al
je 0x406b7c
cmp di, dx
jne 0x406b7c
cmp byte [esi + 4], 0
je 0x406bdb
cmp al, 2
sete al
movzx eax, al
push eax
jmp 0x406ae0
test byte [esi + 0xb], 1
mov ecx, ebp
mov edi, dword [esp + 0x14]
push 0
je 0x406bff
push 0x3fff
push dword [esp + 0x24]
push dword [esp + 0x150]
push edi
jmp 0x4066c2
mov edx, dword [esp + 0x13c]
push SysReAllocString
push 0x3fff
push dword [esp + 0x28]
push dword [esp + 0x154]
push edi
push ebx
call fcn.00407ed0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
cmp byte [esp + 0x11], 0
jne 0x406c41
cmp byte [esi + 0xa], 0
je 0x406ade
cmp byte [esp + 0x12], 0
mov ecx, 0x3fff
jne 0x406c62
cmp di, cx
jne 0x406c62
mov cl, 1
call fcn.00411ce0
mov edi, dword [esp + 0x24]
mov ecx, 0x3fff
cmp dword [0x4d4ba4], 0
mov byte [esp + 0x13], 0
je 0x4073cb
mov edx, dword [esp + 0x144]
test dl, dl
je 0x406c89
cmp byte [esi + 0xa], 0
je 0x4073cb
cmp di, cx
jne 0x40764f
mov al, byte [esp + 0x11]
xor ebp, ebp
cmp byte [esi + 0x13], 0
mov byte [esp + 0x12], al
jbe 0x406dcf
lea ecx, [esi + 0x16]
nop dword [eax]
movzx eax, byte [ecx]
mov ebx, dword [0x4d4bb4]
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
mov ebx, dword [esp + 0x13c]
je 0x406d00
movzx eax, word [ecx + 2]
test eax, 0x4000
je 0x406cf0
test dl, dl
jne 0x406d0e
mov word [esi + 6], ax
mov eax, 0x3fff
mov edi, dword [esp + 0x24]
cmp di, ax
jne 0x406d28
jmp 0x406d00
test dl, dl
jne 0x406d00
mov edi, eax
mov dword [esp + 0x24], edi
mov al, byte [ecx]
mov byte [esp + 0x12], al
movzx eax, byte [esi + 0x13]
inc ebp
add ecx, 4
cmp ebp, eax
jl 0x406cb0
jmp 0x406d1a
mov edi, eax
mov dword [esp + 0x24], edi
mov al, byte [ecx]
mov byte [esp + 0x12], al
mov eax, 0x3fff
cmp di, ax
je 0x406dcf
movzx ecx, byte [esp + 0x12]
mov eax, ecx
sub eax, 0x10
je 0x406da9
sub eax, 1
je 0x406d80
sub eax, 1
je 0x406d57
lea eax, [ecx + ecx*8]
mov ecx, dword [esp + 0x4c]
shl eax, 5
add eax, dword [0x4d4bb4]
mov dword [esp + 0x2c], ecx
jmp 0x406e3e
mov ecx, dword [0x4d4bb4]
mov eax, 0xb880
mov ebp, 0xb9a0
cmp byte [ecx + 0xb9ac], 0
cmovne eax, ebp
add eax, ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x2c], ecx
jmp 0x406e3e
mov ecx, dword [0x4d4bb4]
mov eax, 0xb640
mov ebp, 0xb760
cmp byte [ecx + 0xb76c], 0
cmovne eax, ebp
add eax, ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x2c], ecx
jmp 0x406e3e
mov ecx, dword [0x4d4bb4]
mov eax, 0xb400
mov ebp, 0xb520
cmp byte [ecx + 0xb52c], 0
cmovne eax, ebp
add eax, ecx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x2c], ecx
jmp 0x406e3e
cmp byte [esi + 0x14], 0
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x48], 0
mov dword [esp + 0x2c], ecx
jbe 0x406e51
lea ebp, [esi + 0xde]
nop dword [eax + eax]
movzx eax, word [ebp]
lea ecx, [eax + eax*8]
mov eax, dword [0x4d4bb8]
shl ecx, 5
cmp byte [ecx + eax + 0xc], 0
je 0x406e7b
movzx eax, word [ebp + 2]
test eax, 0x4000
je 0x406e69
test dl, dl
jne 0x406ea3
mov word [esi + 6], ax
mov eax, 0x3fff
mov edi, dword [esp + 0x24]
cmp di, ax
je 0x406e7b
mov ecx, dword [esp + 0x2c]
movzx eax, cx
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4d4bb8]
mov dword [0x4d4ba4], eax
mov eax, 0x3fff
cmp di, ax
jne case.default.0x406e62
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x406e62
jmp dword [eax*4 + 0x407ea4]
test dl, dl
jne 0x406e7b
mov edi, eax
mov dword [esp + 0x24], edi
movzx eax, word [ebp]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x48]
add ebp, 4
movzx eax, byte [esi + 0x14]
inc ecx
mov dword [esp + 0x48], ecx
cmp ecx, eax
jl 0x406df0
mov ecx, dword [esp + 0x2c]
mov eax, 0x3fff
cmp di, ax
je 0x406e51
jmp 0x406e2f
mov edi, eax
mov dword [esp + 0x24], edi
movzx ecx, word [ebp]
mov dword [esp + 0x2c], ecx
jmp 0x406e97
mov eax, 0x1320
jmp 0x406ec6
mov eax, 0x1440
jmp 0x406ec6
mov eax, 0x1200
mov ecx, dword [0x4d4bb4]
mov dword [esp + 0x48], eax
movzx ebp, byte [eax + ecx + 0x13]
mov dword [esp + 0x3c], ebp
xor ebp, ebp
cmp dword [esp + 0x3c], ebp
jbe 0x406f62
add ecx, 0x16
add ecx, eax
nop word [eax + eax]
movzx eax, byte [ecx]
mov ebx, dword [0x4d4bb4]
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
mov ebx, dword [esp + 0x13c]
je 0x406f40
movzx eax, word [ecx + 2]
test eax, 0x4000
je 0x406f30
test dl, dl
jne 0x406f4c
mov word [esi + 6], ax
mov eax, 0x3fff
mov edi, dword [esp + 0x24]
cmp di, ax
jne 0x406f70
jmp 0x406f40
test dl, dl
jne 0x406f40
mov edi, eax
mov dword [esp + 0x24], edi
mov al, byte [ecx]
mov byte [esp + 0x12], al
inc ebp
add ecx, 4
cmp ebp, dword [esp + 0x3c]
jl 0x406ef0
jmp 0x406f58
mov edi, eax
mov dword [esp + 0x24], edi
mov al, byte [ecx]
mov byte [esp + 0x12], al
mov eax, dword [esp + 0x48]
mov ecx, dword [0x4d4bb4]
mov ebp, 0x3fff
cmp di, bp
je 0x407010
movzx ecx, byte [esp + 0x12]
mov eax, ecx
sub eax, 0x10
je 0x406fea
sub eax, 1
je 0x406fc4
sub eax, 1
je 0x406f9d
lea ebp, [ecx + ecx*8]
shl ebp, 5
add ebp, dword [0x4d4bb4]
mov dword [0x4d4ba4], ebp
jmp case.default.0x406e62
mov ecx, dword [0x4d4bb4]
mov ebp, 0xb880
mov eax, 0xb9a0
cmp byte [ecx + 0xb9ac], 0
cmovne ebp, eax
add ebp, ecx
mov dword [0x4d4ba4], ebp
jmp case.default.0x406e62
mov eax, dword [0x4d4bb4]
mov ebp, 0xb640
mov ecx, 0xb760
cmp byte [eax + 0xb76c], 0
cmovne ebp, ecx
add ebp, eax
mov dword [0x4d4ba4], ebp
jmp case.default.0x406e62
mov eax, dword [0x4d4bb4]
mov ebp, 0xb400
mov ecx, 0xb520
cmp byte [eax + 0xb52c], 0
cmovne ebp, ecx
add ebp, eax
mov dword [0x4d4ba4], ebp
jmp case.default.0x406e62
movzx eax, byte [eax + ecx + 0x14]
mov dword [esp + 0x54], eax
mov dword [esp + 0x3c], 0
test eax, eax
je case.default.0x406e62
mov ebp, dword [esp + 0x48]
add ebp, 0xde
add ebp, ecx
nop word [eax + eax]
movzx eax, word [ebp]
lea ecx, [eax + eax*8]
mov eax, dword [0x4d4bb8]
shl ecx, 5
cmp byte [ecx + eax + 0xc], 0
je 0x407091
movzx eax, word [ebp + 2]
test eax, 0x4000
je 0x40707d
test dl, dl
jne 0x4070a9
mov ecx, dword [esp + 0x2c]
mov word [esi + 6], ax
mov eax, 0x3fff
mov edi, dword [esp + 0x24]
cmp di, ax
jne 0x4070bd
jmp 0x407095
test dl, dl
jne 0x407091
mov edi, eax
mov dword [esp + 0x24], edi
movzx ecx, word [ebp]
mov dword [esp + 0x2c], ecx
jmp 0x407095
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
add ebp, 4
inc eax
mov dword [esp + 0x3c], eax
cmp eax, dword [esp + 0x54]
jl 0x407040
jmp 0x4070b3
mov edi, eax
mov dword [esp + 0x24], edi
movzx ecx, word [ebp]
mov eax, 0x3fff
cmp di, ax
je case.default.0x406e62
movzx eax, cx
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4d4bb8]
mov dword [0x4d4ba4], eax
mov ebp, edi
mov ecx, 0x3fff
and ebp, 0x3fff
cmp di, cx
je 0x40717d
cmp bp, word [0x4d30f4]
jae 0x407170
mov ebp, dword [esp + 0x50]
lea eax, [esp + 0x13]
push ebp
push eax
lea eax, [esi + 0xb]
push eax
lea ecx, [esp + 0x30]
call fcn.0040b9f0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4071f1
mov eax, dword [esp + 0x148]
lea ecx, [eax + 0x3c2c17]
cmp ecx, 0x66
ja 0x40714a
movzx edx, byte [edi + 0x21]
mov ecx, 0xffc3d44d
sub ecx, eax
cmp ecx, edx
jg 0x40714a
test ebp, ebp
je 0x407146
mov eax, 0x69
mov word [ebp], ax
xor al, al
jmp 0x40714c
mov al, 1
xor ecx, ecx
test al, al
cmovne ecx, edi
mov dword [esp + 0x40], ecx
test ecx, ecx
je 0x4071f1
mov ebp, dword [esp + 0x24]
mov edx, dword [esp + 0x144]
and ebp, 0x3fff
mov eax, dword [0x4d4ba4]
mov byte [eax + 0x11], 2
mov edi, dword [esp + 0x24]
mov eax, 0x3ffe
cmp bp, ax
je 0x407195
mov eax, 0x3ffd
cmp bp, ax
jne 0x4073c2
test dl, dl
jne 0x40719d
mov byte [esi + 0xf], 1
test byte [0x4d2017], 0xc
jne 0x4071c4
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
xor ecx, ecx
call fcn.0040f910
mov edx, dword [esp + 0x154]
add esp, 0x10
cmp bl, 0xa2
je 0x4071ce
cmp bl, 0xa3
jne 0x40720d
mov edi, dword [esp + 0x14]
test dl, dl
jne 0x407211
push 0xffc3d44d
push 0
push 0
push edi
mov dl, bl
mov ecx, 1
call fcn.0040f910
add esp, 0x10
jmp 0x407211
mov edi, dword [esp + 0x14]
push 0
push 0x3fff
push dword [esp + 0x24]
push dword [esp + 0x150]
push edi
jmp 0x4066be
mov edi, dword [esp + 0x14]
mov eax, dword [0x4d4ba4]
mov byte [eax + 0xd], 1
mov eax, 0x3ffd
cmp bp, ax
jne 0x407252
test byte [0x4d2017], 0x30
jne 0x407244
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
xor ecx, ecx
call fcn.0040f910
add esp, 0x10
mov eax, dword [0x4d4ba4]
mov byte [eax + 0xe], 1
jmp 0x4072cf
mov eax, 0x3ffe
cmp bp, ax
jne 0x4072cf
cmp bl, 0xa0
je 0x407266
cmp bl, 0xa1
jne 0x407289
cmp byte [esp + 0x144], 0
jne 0x407289
push 0xffc3d44d
push 0
push 0
push edi
mov dl, bl
mov ecx, 1
call fcn.0040f910
add esp, 0x10
test byte [0x4d2017], 0x10
je 0x4072ac
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0xa0
mov ecx, 1
call fcn.0040f910
add esp, 0x10
test byte [0x4d2017], 0x20
je 0x4072cf
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0xa1
mov ecx, 1
call fcn.0040f910
add esp, 0x10
test byte [0x4d2017], 1
je 0x4072f2
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0xa2
mov ecx, 1
call fcn.0040f910
add esp, 0x10
test byte [0x4d2017], 2
je 0x407315
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0xa3
mov ecx, 1
call fcn.0040f910
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 9
mov ecx, 2
call fcn.0040f910
mov eax, 0x3ffd
add esp, 0x10
cmp bp, ax
jne 0x407376
mov eax, dword [0x4d4ba4]
cmp byte [eax + 0xe], 0
je 0x407376
cmp bl, 0x60
jb 0x40734e
cmp bl, 0x69
jbe 0x407353
cmp bl, 0x6e
jne 0x407376
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
mov ecx, 1
call fcn.0040f910
mov eax, dword [0x4d4ba4]
add esp, 0x10
mov byte [eax + 0xe], 0
mov eax, dword [esp + 0x50]
mov ecx, 0x68
mov word [eax], cx
mov eax, dword [esp + 0x144]
test al, al
jne 0x407391
mov byte [esi + 0x10], 1
mov edx, dword [esp + 0x138]
mov ecx, dword [esp + 0x28]
push 0
push SysReAllocString
push 0x3fff
push dword [esp + 0x28]
push eax
push edi
push ebx
call fcn.00407ed0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
mov ebp, dword [esp + 0x28]
mov ecx, 0x3fff
cmp di, cx
jne 0x407648
mov al, byte [esi + 4]
mov dl, byte [0x4d2016]
test al, al
je 0x4073e5
not al
and dl, al
mov dh, byte [esp + 0x3b]
cmp ebp, dword [0x4d16a0]
jne 0x407411
test dh, dh
je 0x407411
mov eax, dword [0x4d4bac]
movzx ecx, dl
shl ecx, 9
add ecx, dword [esp + 0x44]
movzx eax, word [eax + ecx*2]
movzx ecx, bl
mov dword [esp + 0x3c], ecx
jmp 0x407429
movzx eax, bl
movzx ecx, dl
shl ecx, 8
mov dword [esp + 0x3c], eax
add ecx, eax
mov eax, dword [0x4d4ba8]
movzx eax, word [eax + ecx*2]
movzx ebp, ax
mov ecx, ebp
movzx edi, ax
mov dword [esp + 0x24], edi
cmp ax, word [esp + 0x58]
jne 0x4074af
cmp byte [0x4d4ba0], 0
je 0x4074af
cmp bl, 9
je 0x4074af
mov eax, dword [esp + 0x28]
and dl, 0xf3
cmp eax, dword [0x4d16a0]
jne 0x40746e
test dh, dh
je 0x40746e
mov eax, dword [0x4d4bac]
movzx ecx, dl
shl ecx, 9
add ecx, dword [esp + 0x44]
jmp 0x40747d
mov eax, dword [0x4d4ba8]
movzx ecx, dl
shl ecx, 8
add ecx, dword [esp + 0x3c]
movzx eax, word [eax + ecx*2]
mov edx, 0x3ff9
movzx edi, ax
movzx ecx, ax
and eax, 0x3fff
mov dword [esp + 0x24], edi
cmp ax, dx
jbe 0x4074a4
mov edx, 0x3fff
cmp ax, dx
jb 0x4074af
mov edi, 0x3fff
mov dword [esp + 0x24], edi
mov ecx, edi
movzx eax, cx
test eax, 0x4000
je 0x4074fc
mov edx, dword [esp + 0x144]
test dl, dl
jne 0x4075a7
mov word [esi + 6], di
mov dword [esp + 0x24], 0x3fff
lea ecx, [esi + 6]
mov eax, 0x3fff
push 0
cmp word [ecx], ax
jne 0x40760d
mov edi, dword [esp + 0x18]
push 0x3fff
push dword [esp + 0x24]
push 0
push edi
jmp 0x4066be
mov ecx, 0x3fff
cmp ax, cx
je 0x4075b5
mov edx, dword [esp + 0x144]
and eax, ecx
test dl, dl
je 0x40758b
cmp ax, word [0x4d30f4]
jae 0x40757e
mov ebp, eax
mov eax, dword [0x4d4bb0]
cmp word [eax + ebp*2], cx
je 0x40757e
cmp byte [esp + 0x1b], 0
jne 0x40756f
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x24]
push eax
lea eax, [esp + 0x17]
push eax
lea eax, [esi + 0xb]
push eax
push dword [esp + 0x154]
call fcn.0040b980
mov edx, dword [esp + 0x154]
add esp, 0x10
mov dword [esp + 0x40], eax
mov ecx, 0x3fff
test eax, eax
je 0x40756f
mov edi, dword [esp + 0x24]
jmp 0x4075ac
mov eax, dword [0x4d4bb0]
movzx edi, word [eax + ebp*2]
mov dword [esp + 0x24], edi
jmp 0x4075ac
cmp byte [esp + 0x1b], 0
je 0x4075ac
mov dword [esp + 0x24], ecx
jmp 0x4075b5
cmp ax, word [0x4d30f4]
jae 0x4075ac
mov ecx, eax
mov eax, dword [0x4d4bb0]
mov ax, word [eax + ecx*2]
mov word [esi + 6], ax
mov edi, dword [esp + 0x24]
mov ecx, 0x3fff
cmp di, cx
jne 0x40764f
mov eax, dword [esp + 0x144]
test al, al
je 0x4074d4
cmp byte [esi + 4], 0
jne 0x4075f7
test byte [esi + 0xb], 1
jne 0x4075f7
cmp byte [esi + 8], 0
je 0x4075f7
cmp byte [esp + 0x23], 0
jne 0x4075f7
mov ecx, dword [esp + 0x28]
push 0
push SysReAllocString
push 0x3fff
push dword [esp + 0x28]
push eax
jmp 0x406996
mov edi, dword [esp + 0x14]
push 0
push 0x3fff
push dword [esp + 0x24]
push eax
push edi
jmp 0x4066be
lea eax, [esp + 0x17]
mov dl, 1
push eax
lea eax, [esi + 0xb]
push eax
push 0
call fcn.0040b980
mov edi, dword [esp + 0x24]
add esp, 0x10
cmp byte [esp + 0x13], 0
mov ecx, dword [esp + 0x28]
push 0
je 0x407742
push 0x3fff
push dword [esp + 0x24]
push 0
push edi
jmp 0x4066c2
mov edx, dword [esp + 0x144]
test byte [esi + 0xb], 8
lea ebp, [esi + 0xb]
je 0x407669
test dl, dl
je 0x407669
mov byte [esp + 0x13], 1
and byte [ebp], 0xf7
mov edi, dword [esp + 0x24]
mov eax, edi
and eax, 0x3fff
cmp ax, word [0x4d30f4]
jae 0x407772
cmp dword [esp + 0x40], 0
jne 0x407772
push dword [esp + 0x50]
lea eax, [esp + 0x17]
push eax
push ebp
push dword [esp + 0x154]
lea ecx, [esp + 0x34]
call fcn.0040b980
add esp, 0x10
mov dword [esp + 0x40], eax
test eax, eax
jne 0x40776e
mov eax, dword [esp + 0x144]
push 0
test al, al
je 0x4076f0
cmp byte [esi + 0x10], 0
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
je 0x4076e0
push SysReAllocString
push 0x3fff
push dword [esp + 0x28]
push eax
jmp 0x40699a
push 0x3fff
push dword [esp + 0x24]
push eax
push edi
jmp 0x4066c2
lea ecx, [esi + 6]
mov eax, 0x3fff
cmp word [ecx], ax
je 0x4074e7
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
push eax
push ebp
push 0
mov dl, 1
call fcn.0040b980
mov edi, dword [esp + 0x24]
add esp, 0x10
cmp byte [esp + 0x13], 0
mov ecx, dword [esp + 0x28]
push 0
je 0x40773a
push 0x3fff
push dword [esp + 0x24]
push 0
push edi
jmp 0x4066c2
and byte [ebp], 0xf7
mov byte [esi + 0x10], 1
mov edx, dword [esp + 0x13c]
push SysReAllocString
push 0x3fff
push dword [esp + 0x28]
push 0
push edi
push ebx
call fcn.00407ed0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
and edi, 0x3fff
cmp eax, dword [0x4d16a0]
mov al, byte [0x4d2017]
jne 0x4077d6
test al, 0x3f
jne 0x40781f
test al, 0x40
je 0x4077b6
mov ecx, dword [0x4d4bb4]
movzx eax, byte [0x4d4b9c]
cmp byte [ecx + 0x6668], 0
mov ecx, 1
cmove eax, ecx
mov byte [0x4d4b9c], al
test byte [0x4d2017], 0x80
mov eax, dword [0x4d4bb4]
je 0x407824
cmp byte [eax + 0x6788], 0
jne 0x407824
mov byte [0x4d4b9d], 1
jmp 0x407824
test al, 0xc
jne 0x40781f
test al, 0x40
mov eax, dword [0x4d4bb4]
je 0x4077f5
cmp byte [eax + 0x6668], 0
jne 0x4077f5
mov byte [0x4d4b9c], 1
jmp 0x407824
test byte [0x4d2017], 0x80
je 0x407824
mov ecx, dword [0x4d4bb4]
movzx eax, byte [0x4d4b9d]
cmp byte [ecx + 0x6788], 0
mov ecx, 1
cmove eax, ecx
mov byte [0x4d4b9d], al
mov eax, dword [0x4d4bb4]
test byte [0x4d2017], 4
je 0x407848
cmp byte [eax + 0xb888], 0
jne 0x407848
cmp dword [0x4d16a0], 0
je 0x407875
mov byte [0x4d4b9e], 1
jmp 0x407893
test byte [0x4d2017], 8
je 0x407893
cmp byte [eax + 0xb9a8], 0
jne 0x407893
call fcn.00412290
test al, al
jne 0x407893
cmp dword [0x4d16a0], 0
je 0x407875
mov byte [0x4d4b9f], 1
jmp 0x407893
mov dl, byte [0x4cfaa3]
mov ecx, 2
push 0xffc3d44d
push 0
push 0
push 0
call fcn.0040f910
add esp, 0x10
mov eax, edi
lea ecx, [eax - 0x3ffa]
cmp ecx, 4
ja case.default.0x4078a4
jmp dword [ecx*4 + 0x407ebc]
cmp byte [0x4d4ba0], 0
je 0x4071f1
xor al, al
test byte [0x4d2017], 4
je 0x4078ca
mov edx, 0xa4
jmp 0x4078dc
test byte [0x4d2017], 8
movzx edx, al
mov eax, 0xa5
cmovne edx, eax
cmp byte [0x4d4ba0], 0
mov dword [esp + 0x3c], edx
je 0x407962
mov eax, 0x3ffb
cmp di, ax
je case.0x4078a4.16381
test dl, dl
movzx eax, dl
push 0xffc3d44d
mov ecx, 0x12
mov edi, 1
cmovne ecx, eax
push 0
push 0
mov dl, cl
mov ecx, edi
push 0
call fcn.0040f910
add esp, 0x10
cmp byte [esi + 4], 0
je 0x407951
cmp bl, 0x5b
je 0x407951
cmp bl, 0x5c
je 0x407951
cmp byte [esp + 0x144], 0
jne 0x407951
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, edi
call fcn.0040f910
add esp, 0x10
mov byte [0x4d4ba0], 0
mov edi, 0x3fff
jmp 0x407bfd
cmp bl, 0xa4
je 0x407971
mov byte [esp + 0x33], 0
cmp bl, 0xa5
jne 0x407976
mov byte [esp + 0x33], 1
cmp bl, 0xa0
je 0x407984
cmp bl, 0xa1
je 0x407984
xor cl, cl
jmp 0x407986
mov cl, 1
mov byte [esp + 0x1b], cl
cmp bl, 0xa2
je 0x407999
mov byte [esp + 0x11], 0
cmp bl, 0xa3
jne 0x40799e
mov byte [esp + 0x11], 1
xor dl, dl
test byte [0x4d2017], 0x10
mov dword [esp + 0x40], edx
je 0x4079b4
mov edx, 0xa0
jmp 0x4079d7
test byte [0x4d2017], 0x20
mov eax, dword [esp + 0x144]
je 0x4079c8
mov dl, 0xa1
jmp 0x4079de
test al, al
jne 0x4079e2
test cl, cl
movzx edx, dl
movzx eax, bl
cmovne edx, eax
mov eax, dword [esp + 0x144]
mov dword [esp + 0x40], edx
xor cl, cl
test byte [0x4d2017], 1
mov dword [esp + 0x44], ecx
je 0x4079f8
mov byte [esp + 0x44], 0xa2
jmp 0x407a1e
test byte [0x4d2017], 2
je 0x407a08
mov byte [esp + 0x44], 0xa3
jmp 0x407a1e
test al, al
jne 0x407a1e
cmp byte [esp + 0x11], 0
movzx ecx, cl
movzx eax, bl
cmovne ecx, eax
mov dword [esp + 0x44], ecx
mov byte [esp + 0x11], 0
mov edi, 1
test dl, dl
je 0x407a46
push 0xffc3d44d
push 0
push 0
push 0
mov ecx, edi
call fcn.0040f910
add esp, 0x10
mov byte [esp + 0x11], 1
mov eax, dword [esp + 0x44]
test al, al
je 0x407a65
push 0xffc3d44d
push 0
push 0
push 0
mov dl, al
mov ecx, edi
call fcn.0040f910
add esp, 0x10
cmp byte [esp + 0x33], 0
je 0x407a7a
cmp byte [esp + 0x144], 0
jne 0x407a82
mov al, bl
jmp 0x407a7e
mov eax, dword [esp + 0x3c]
test al, al
jne 0x407a99
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
xor ecx, ecx
call fcn.0040f910
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 9
mov ecx, 2
call fcn.0040f910
add esp, 0x10
cmp byte [esp + 0x11], 0
je 0x407ada
cmp byte [esp + 0x1b], 0
jne 0x407ada
mov dl, byte [esp + 0x40]
xor ecx, ecx
push 0xffc3d44d
push 0
push 0
push 0
call fcn.0040f910
add esp, 0x10
mov byte [0x4d4ba0], 1
mov edi, 0x3fff
jmp 0x407bfd
cmp byte [0x4d4ba0], 0
je 0x4071f1
mov eax, dword [esp + 0x144]
test al, al
jne 0x407b38
cmp bl, 0xa2
je 0x407b17
cmp bl, 0xa3
je 0x407b17
cmp bl, 0xa0
je 0x407b17
cmp bl, 0xa1
jne 0x407b38
push 0xffc3d44d
push 0
push 0
push 0
mov dl, bl
mov ecx, 1
call fcn.0040f910
mov eax, dword [esp + 0x154]
add esp, 0x10
test byte [0x4d2017], 0xc
je 0x407b4f
test al, al
je 0x407b66
cmp bl, 0xa4
je 0x407b4f
cmp bl, 0xa5
jne 0x407b66
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x12
xor ecx, ecx
call fcn.0040f910
add esp, 0x10
mov eax, 0x3ffd
mov byte [esp + 0x11], 0
cmp di, ax
jne 0x407b9a
test byte [0x4d2017], 0x30
jne 0x407b9a
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
xor ecx, ecx
call fcn.0040f910
add esp, 0x10
mov byte [esp + 0x11], 1
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 9
mov ecx, 2
call fcn.0040f910
add esp, 0x10
cmp byte [esp + 0x11], 0
je 0x407958
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x10
mov ecx, 1
call fcn.0040f910
add esp, 0x10
mov edi, 0x3fff
jmp 0x407bfd
mov edi, eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x4c], edi
cmp byte [eax + 0x1e], 5
jne 0x407bfd
movzx eax, word [eax + 0x1c]
shl eax, 0x10
or edi, eax
mov dword [esp + 0x4c], edi
cmp byte [esp + 0x23], 0
mov ecx, 0x68
mov eax, dword [esp + 0x50]
mov word [eax], cx
mov eax, dword [esp + 0x144]
je 0x407c8c
test al, al
je 0x407ce1
cmp byte [esi + 8], 0
je 0x407c8c
mov edi, dword [esp + 0x14]
mov dl, bl
push 0xffc3d44e
push 0
push 0
push edi
mov ecx, 1
call fcn.0040f910
push 0xffc3d44d
push 0
push 0
push edi
mov dl, bl
mov ecx, 2
call fcn.0040f910
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x158]
push 0
push SysReAllocString
push ecx
push dword [esp + 0x48]
mov ecx, dword [esp + 0x58]
push dword [esp + 0x174]
push edi
push ebx
call fcn.00407ed0
add esp, 0x3c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
test al, al
je 0x407ce1
cmp byte [esi + 4], 0
je 0x407cc4
cmp byte [esi + 0x10], 0
mov ecx, dword [esp + 0x28]
je 0x407cb2
push 0
push SysReAllocString
push edi
push dword [esp + 0x28]
push eax
jmp 0x406996
push 1
push edi
push dword [esp + 0x24]
mov edi, dword [esp + 0x20]
push eax
push edi
jmp 0x4066c2
cmp byte [esp + 0x13], 0
je 0x407d71
push 0
push edi
push dword [esp + 0x24]
mov edi, dword [esp + 0x20]
push eax
push edi
jmp 0x4066be
mov edx, dword [0x4d4ba4]
mov byte [esi + 0xf], 1
test edx, edx
je 0x407cf9
cmp byte [edx + 4], 0
je 0x407cf9
mov byte [edx + 0x11], 2
cmp byte [esp + 0x13], 0
je 0x407d16
or byte [ebp], 8
push 0
push edi
push dword [esp + 0x24]
mov edi, dword [esp + 0x20]
push eax
push edi
jmp 0x4066be
cmp bl, 0xa4
je 0x407d20
cmp bl, 0xa5
jne 0x407d71
mov al, byte [0x4d2017]
test al, 0xc0
je 0x407d4b
test al, 0x33
jne 0x407d4b
mov dl, byte [0x4cfaa3]
mov ecx, 2
push 0xffc3d44d
push 0
push 0
push 0
call fcn.0040f910
add esp, 0x10
mov edi, dword [esp + 0x14]
mov dl, bl
push 0xffc3d44d
push 0
push 0
push edi
mov ecx, 1
call fcn.0040f910
mov eax, dword [esp + 0x154]
add esp, 0x10
jmp 0x407d75
mov edi, dword [esp + 0x14]
test al, al
jne 0x407d7d
mov byte [esi + 0x10], 1
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x138]
push 0
push SysReAllocString
push ecx
push dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push eax
push edi
push ebx
call fcn.00407ed0
add esp, 0x1c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret