Function at 0x401a40
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x728
push ebx
push esi
mov esi, ecx
push edi
lea eax, [ebp - 0x15c]
push dword [esi + 0x48]
push dword [esi + 0x44]
push eax
call fcn.00403ed6
lea eax, [ebp - 0x15c]
lea ecx, [ebp - 0x90]
push eax
push 0x4206d8
call fcn.00416404
lea eax, [esi + 0x4c]
lea ecx, [ebp - 0x90]
push eax
push 0x4206d0
call fcn.00416526
push 1
xor ebx, ebx
pop edi
cmp eax, edi
je 0x401aea
push dword [esi + 0x48]
lea eax, [ebp - 0x15c]
mov ecx, esi
push ebx
push eax
call fcn.00403ed6
lea eax, [ebp - 0x15c]
lea ecx, [ebp - 0x90]
push eax
push 0x4206d8
call fcn.00416432
lea eax, [esi + 0x4c]
lea ecx, [ebp - 0x90]
push eax
push 0x4206d0
call fcn.00416526
cmp eax, edi
je 0x401aea
push 0x4206c4
push 0x4206d8
lea ecx, [ebp - 0x90]
call fcn.00416432
push 3
mov dword [esi + 0x58], ebx
mov dword [esi + 0x390], ebx
pop eax
mov dword [esi + 0x2e4], ebx
mov dword [esi + 0x2e8], eax
mov dword [esi + 0x2ec], 0x53
mov dword [esi + 0x2f0], 0x52
mov dword [esi + 0x2f4], 0x44
mov dword [esi + 0x394], 0xbb8
mov dword [esi + 0x398], 0x5dc
mov dword [esi + 0x39c], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
jb 0x401b55
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x401b55
push 0x64
jmp 0x401b57
push 0x1e
pop eax
mov dword [esi + 0x3a0], eax
mov dword [esi + 0x54], ebx
mov dword [esi + 0x810], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], edi
mov dword [esi + 0x270], ebx
mov dword [esi + 0x274], ebx
mov dword [esi + 0x278], 8
mov dword [esi + 0x27c], ebx
mov dword [esi + 0x288], 0xc
mov dword [esi + 0x290], ebx
mov dword [esi + 0x60], 0x1f4
mov dword [esi + 0x2d8], edi
mov dword [esi + 0x2dc], edi
mov dword [esi + 0x2e0], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x388], ebx
mov dword [esi + 0x9ac], ebx
mov dword [esi + 0x320], edi
mov byte [esi + 0x324], bl
mov byte [esi + 0x356], bl
mov dword [esi + 0x38c], edi
mov dword [esi + 0x7c0], ebx
mov dword [esi + 0x7c4], 0xa
mov dword [esi + 0x7c8], 0xed4e00
mov dword [esi + 0x7cc], ebx
mov dword [esi + 0x7d0], edi
mov dword [esi + 0x7d4], ebx
mov dword [esi + 0x7d8], edi
mov dword [esi + 0x2f8], ebx
mov dword [esi + 0x2fc], edi
mov dword [esi + 0x38], 5
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x304], edi
mov dword [esi + 0x308], ebx
mov dword [esi + 0x30c], ebx
mov dword [esi + 0x310], 0x14
mov dword [esi + 0x314], 0x800000
mov dword [esi + 0x318], 0x10000
mov dword [esi + 0x31c], 0x40000
mov dword [esi + 0x2c4], ebx
mov dword [esi + 0x2d4], ebx
mov dword [esi + 0x2a8], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jb 0x401c88
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x401c88
push 2
jmp 0x401c8a
push 3
pop eax
mov dword [esi + 0x2c8], eax
lea eax, [esi + 0x7dc]
push 0x32
push 0x4206c0
mov dword [esi + 0x2cc], ebx
push eax
mov dword [esi + 0x2d0], ebx
call fcn.0040b2aa
lea eax, [esi + 0x300]
mov dword [esi + 0x814], 0x61
mov dword [esi + 0x818], 0x10
mov dword [esi + 0x81c], 0x58
mov dword [esi + 0x820], 0x3a
mov dword [esi + 0x824], 0x6e
mov dword [esi + 0x828], 0x5a
mov dword [esi + 0x82c], 0x15
or dword [eax], edi
or dword [eax], 4
or dword [eax], 8
add esp, 0xc
xor ecx, ecx
lea eax, [esi + 0x830]
mov dword [eax], ecx
inc ecx
add eax, 4
cmp ecx, 7
jl 0x401d0f
lea eax, [esi + 0x68]
push 0x104
push 0x4206b4
push eax
mov dword [esi + 0x84c], ebx
mov dword [esi + 0x850], ebx
mov dword [esi + 0x854], ebx
mov dword [esi + 0x858], ebx
mov dword [esi + 0x85c], ebx
mov dword [esi + 0x860], ebx
mov dword [esi + 0x864], ebx
mov dword [esi + 0x868], ebx
mov dword [esi + 0x86c], ebx
mov dword [esi + 0x870], ebx
mov dword [esi + 0x874], ebx
mov dword [esi + 0x64], edi
mov dword [esi + 0x99c], edi
call fcn.0040b2aa
lea eax, [esi + 0x878]
push 0x3c
push ebx
push eax
mov byte [esi + 0x16c], bl
mov byte [esi + 0x3ae], bl
mov byte [esi + 0x4b2], bl
mov byte [esi + 0x6ba], bl
mov byte [esi + 0x5b6], bl
call fcn.00417010
lea eax, [esi + 0x8b4]
push 0x3c
push ebx
push eax
call fcn.00417010
lea eax, [esi + 0x8f0]
push 0x3c
push ebx
push eax
call fcn.00417010
lea eax, [esi + 0x92c]
push 0x3c
push ebx
push eax
call fcn.00417010
add esp, 0x3c
lea eax, [esi + 0x58]
lea ecx, [ebp - 0x90]
push eax
push 0x4206ac
call fcn.00416526
lea eax, [esi + 0x390]
lea ecx, [ebp - 0x90]
push eax
push 0x4206a4
call fcn.00416526
lea eax, [esi + 0x394]
lea ecx, [ebp - 0x90]
push eax
push 0x420698
call fcn.00416526
lea eax, [esi + 0x398]
lea ecx, [ebp - 0x90]
push eax
push 0x42068c
call fcn.00416526
lea eax, [esi + 0x39c]
lea ecx, [ebp - 0x90]
push eax
push 0x420680
call fcn.00416526
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 4
jb 0x401e61
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
mov ecx, 0x420674
jb 0x401e66
mov ecx, 0x420668
lea eax, [esi + 0x3a0]
push eax
push ecx
lea ecx, [ebp - 0x90]
call fcn.00416526
lea eax, [esi + 0x54]
lea ecx, [ebp - 0x90]
push eax
push 0x420660
call fcn.00416526
lea eax, [esi + 0x810]
lea ecx, [ebp - 0x90]
push eax
push 0x420658
call fcn.00416526
lea eax, [esi + 0x4c]
lea ecx, [ebp - 0x90]
push eax
push 0x4206d0
call fcn.00416526
lea eax, [esi + 0x50]
lea ecx, [ebp - 0x90]
push eax
push 0x42064c
call fcn.00416526
lea eax, [esi + 0x270]
lea ecx, [ebp - 0x90]
push eax
push 0x420640
call fcn.00416526
cmp dword [esi + 0x270], ebx
je 0x401f02
lea eax, [esi + 0x274]
lea ecx, [ebp - 0x90]
push eax
push 0x420630
call fcn.00416526
lea eax, [esi + 0x278]
lea ecx, [ebp - 0x90]
push eax
push 0x420624
call fcn.00416526
lea eax, [esi + 0x304]
lea ecx, [ebp - 0x90]
push eax
push 0x420614
call fcn.00416526
lea eax, [esi + 0x308]
lea ecx, [ebp - 0x90]
push eax
push 0x420604
call fcn.00416526
lea eax, [esi + 0x30c]
lea ecx, [ebp - 0x90]
push eax
push 0x4205f8
call fcn.00416526
lea eax, [esi + 0x310]
lea ecx, [ebp - 0x90]
push eax
push 0x4205ec
call fcn.00416526
lea eax, [esi + 0x314]
lea ecx, [ebp - 0x90]
push eax
push 0x4205e4
call fcn.00416526
cmp dword [esi + 0x314], 0x100000
jge 0x401fa2
mov dword [esi + 0x314], 0x800000
lea eax, [esi + 0x318]
lea ecx, [ebp - 0x90]
push eax
push 0x4205d8
call fcn.00416526
cmp dword [esi + 0x318], 0x2000
jge 0x401fcf
mov dword [esi + 0x318], 0x10000
lea eax, [esi + 0x31c]
lea ecx, [ebp - 0x90]
push eax
push 0x4205cc
call fcn.00416526
cmp dword [esi + 0x31c], 0x2000
jge 0x401ffc
mov dword [esi + 0x31c], 0x40000
mov eax, dword [esi + 0x278]
imul eax, eax, 0x104
push eax
call fcn.00416ff4
mov ecx, dword [esi + 0x278]
mov dword [esi + 0x280], eax
imul ecx, ecx, 0x104
push ecx
push ebx
push eax
call fcn.00417010
add esp, 0x10
lea ecx, [ebp - 0x90]
push 0x104
push dword [esi + 0x280]
push 0x4205c0
call fcn.004165ed
mov eax, dword [esi + 0x278]
imul eax, eax, 0x32
push eax
call fcn.00416ff4
mov ecx, dword [esi + 0x278]
mov dword [esi + 0x284], eax
imul ecx, ecx, 0x32
push ecx
push ebx
push eax
call fcn.00417010
add esp, 0x10
lea ecx, [ebp - 0x90]
push edi
push 0x4205c0
call fcn.004164a1
test eax, eax
je 0x40219c
cmp dword [esi + 0x278], ebx
mov dword [ebp - 8], ebx
jle 0x402191
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
push dword [ebp - 8]
lea eax, [ebp - 0x260]
push 0x4205c0
push 0x4205b8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0xc]
add esp, 0x10
add eax, dword [esi + 0x280]
lea ecx, [ebp - 0x90]
push 0x104
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004165ed
cmp eax, edi
je 0x40210d
cmp dword [ebp - 0xc], 0x820
jge 0x4020ed
mov eax, dword [ebp - 8]
jmp 0x4020ef
xor eax, eax
push 0x104
push dword [eax*4 + 0x420094]
mov eax, dword [ebp - 0xc]
add eax, dword [esi + 0x280]
push eax
call fcn.0040b2aa
add esp, 0xc
push dword [ebp - 8]
lea eax, [ebp - 0x260]
push 0x4205ac
push 0x4205b8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 4]
add esp, 0x10
add eax, dword [esi + 0x284]
lea ecx, [ebp - 0x90]
push 0x32
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004165ed
cmp eax, edi
je 0x402174
cmp dword [ebp - 0xc], 0x820
jge 0x40215a
mov eax, dword [ebp - 8]
jmp 0x40215c
xor eax, eax
push dword [eax*4 + 0x4200b4]
mov eax, dword [ebp - 4]
add eax, dword [esi + 0x284]
push eax
call fcn.00417440
pop ecx
pop ecx
inc dword [ebp - 8]
add dword [ebp - 0xc], 0x104
mov eax, dword [ebp - 8]
add dword [ebp - 4], 0x32
cmp eax, dword [esi + 0x278]
jl 0x40209d
lea ecx, [ebp - 0x90]
call fcn.0041650a
push edi
push 0x4205a4
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x40226c
lea eax, [esi + 0x288]
lea ecx, [ebp - 0x90]
push eax
push 0x420598
call fcn.00416526
lea eax, [esi + 0x290]
lea ecx, [ebp - 0x90]
push eax
push 0x420590
call fcn.00416526
mov eax, dword [esi + 0x288]
imul eax, eax, 0x32
push eax
call fcn.00416ff4
cmp dword [esi + 0x288], ebx
pop ecx
mov dword [esi + 0x28c], eax
mov dword [ebp - 0xc], ebx
jle 0x40225f
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
lea eax, [ebp - 0x260]
push 0x42058c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, dword [esi + 0x28c]
lea ecx, [ebp - 0x90]
push 0x32
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004165ed
cmp eax, edi
je 0x40224d
mov eax, dword [esi + 0x28c]
mov ecx, dword [ebp - 4]
mov byte [ecx + eax], bl
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], 0x32
cmp eax, dword [esi + 0x288]
jl 0x402207
lea ecx, [ebp - 0x90]
call fcn.0041650a
jmp 0x402295
mov eax, dword [esi + 0x288]
imul eax, eax, 0x32
push eax
call fcn.00416ff4
mov ecx, dword [esi + 0x288]
mov dword [esi + 0x28c], eax
imul ecx, ecx, 0x32
push ecx
push ebx
push eax
call fcn.00417010
add esp, 0x10
lea eax, [esi + 0x968]
push 0x32
push eax
push 0x420580
lea ecx, [ebp - 0x90]
mov byte [eax], bl
call fcn.004165ed
lea eax, [esi + 0x99c]
lea ecx, [ebp - 0x90]
push eax
push 0x420570
call fcn.00416526
lea eax, [esi + 0x60]
lea ecx, [ebp - 0x90]
push eax
push 0x420564
call fcn.00416526
lea eax, [esi + 0x2d8]
lea ecx, [ebp - 0x90]
push eax
push 0x420558
call fcn.00416526
lea eax, [esi + 0x2dc]
lea ecx, [ebp - 0x90]
push eax
push 0x42054c
call fcn.00416526
lea eax, [esi + 0x2e0]
lea ecx, [ebp - 0x90]
push eax
push 0x420540
call fcn.00416526
lea eax, [esi + 0x5c]
lea ecx, [ebp - 0x90]
push eax
push 0x420530
call fcn.00416526
lea eax, [esi + 0x388]
lea ecx, [ebp - 0x90]
push eax
push 0x420520
call fcn.00416526
lea eax, [esi + 0x9ac]
lea ecx, [ebp - 0x90]
push eax
push 0x420514
call fcn.00416526
lea eax, [esi + 0x320]
lea ecx, [ebp - 0x90]
push eax
push 0x420504
call fcn.00416526
lea eax, [esi + 0x320]
xor ecx, ecx
cmp dword [eax], edi
sete cl
mov dword [eax], ecx
lea eax, [esi + 0x38c]
push eax
push 0x4204f4
lea ecx, [ebp - 0x90]
call fcn.00416526
lea eax, [esi + 0x324]
push 0x32
push eax
push 0x4204e8
lea ecx, [ebp - 0x90]
call fcn.004165ed
lea eax, [esi + 0x356]
push 0x32
push eax
push 0x4204d8
lea ecx, [ebp - 0x90]
call fcn.004165ed
lea eax, [esi + 0x3a4]
push 0xa
push eax
push 0x4204d0
lea ecx, [ebp - 0x90]
call fcn.004165ed
lea eax, [esi + 0x7c0]
push eax
push 0x4204c8
lea ecx, [ebp - 0x90]
call fcn.00416558
lea eax, [esi + 0x7c8]
lea ecx, [ebp - 0x90]
push eax
push 0x4204b8
call fcn.00416526
lea eax, [esi + 0x7cc]
lea ecx, [ebp - 0x90]
push eax
push 0x4204ac
call fcn.00416526
lea eax, [esi + 0x7d0]
lea ecx, [ebp - 0x90]
push eax
push 0x4204a0
call fcn.00416526
lea eax, [esi + 0x7d4]
lea ecx, [ebp - 0x90]
push eax
push 0x420494
call fcn.00416526
lea eax, [esi + 0x7d8]
lea ecx, [ebp - 0x90]
push eax
push 0x420488
call fcn.00416526
lea eax, [esi + 0x2f8]
lea ecx, [ebp - 0x90]
push eax
push 0x42047c
call fcn.00416526
lea eax, [esi + 0x2fc]
lea ecx, [ebp - 0x90]
push eax
push 0x420470
call fcn.00416526
lea eax, [esi + 0x300]
lea ecx, [ebp - 0x90]
push eax
push 0x420464
call fcn.00416526
lea eax, [esi + 0x7dc]
push 0x32
push eax
push 0x420458
lea ecx, [ebp - 0x90]
call fcn.004165ed
push edi
push 0x420450
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x402565
lea eax, [esi + 0x2e4]
lea ecx, [ebp - 0x90]
push eax
push 0x420444
call fcn.00416526
lea eax, [esi + 0x2e8]
lea ecx, [ebp - 0x90]
push eax
push 0x420434
call fcn.00416526
lea eax, [esi + 0x2ec]
lea ecx, [ebp - 0x90]
push eax
push 0x420428
call fcn.00416526
lea eax, [esi + 0x2f0]
lea ecx, [ebp - 0x90]
push eax
push 0x42041c
call fcn.00416526
lea eax, [esi + 0x2f4]
lea ecx, [ebp - 0x90]
push eax
push 0x420410
call fcn.00416526
lea ecx, [ebp - 0x90]
call fcn.0041650a
lea eax, [esi + 0x64]
lea ecx, [ebp - 0x90]
push eax
push 0x420404
call fcn.00416526
lea eax, [esi + 0x68]
push 0x104
push eax
push 0x4203fc
lea ecx, [ebp - 0x90]
call fcn.004165ed
cmp dword [esi + 0x64], ebx
je 0x4025a1
lea eax, [esi + 0x68]
push eax
call fcn.00404c2c
pop ecx
lea eax, [esi + 0x16c]
push 0x104
push eax
push 0x4203f0
lea ecx, [ebp - 0x90]
call fcn.004165ed
lea eax, [esi + 0x3ae]
push 0x104
push eax
push 0x4203e8
lea ecx, [ebp - 0x90]
call fcn.004165ed
lea eax, [esi + 0x4b2]
push 0x104
push eax
push 0x4203e0
lea ecx, [ebp - 0x90]
call fcn.004165ed
lea eax, [esi + 0x6ba]
push 0x104
push eax
push 0x4203d4
lea ecx, [ebp - 0x90]
call fcn.004165ed
lea eax, [esi + 0x5b6]
push 0x104
push eax
push 0x4203c8
lea ecx, [ebp - 0x90]
call fcn.004165ed
push edi
push 0x4203bc
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x4028bd
lea eax, [esi + 0x814]
lea ecx, [ebp - 0x90]
push eax
push 0x4203ac
call fcn.00416526
lea eax, [esi + 0x828]
lea ecx, [ebp - 0x90]
push eax
push 0x42039c
call fcn.00416526
lea eax, [esi + 0x818]
lea ecx, [ebp - 0x90]
push eax
push 0x420390
call fcn.00416526
lea eax, [esi + 0x82c]
lea ecx, [ebp - 0x90]
push eax
push 0x420380
call fcn.00416526
lea eax, [esi + 0x81c]
lea ecx, [ebp - 0x90]
push eax
push 0x420370
call fcn.00416526
lea eax, [esi + 0x820]
lea ecx, [ebp - 0x90]
push eax
push 0x420360
call fcn.00416526
lea eax, [esi + 0x824]
lea ecx, [ebp - 0x90]
push eax
push 0x420354
call fcn.00416526
push edi
push 0x420348
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x40274d
lea eax, [esi + 0x830]
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
lea eax, [ebp - 0x15c]
push 0x42058c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x15c]
lea ecx, [ebp - 0x90]
push dword [ebp - 0xc]
push eax
call fcn.00416526
inc dword [ebp - 4]
add dword [ebp - 0xc], 4
cmp dword [ebp - 4], 7
jl 0x402708
lea ecx, [ebp - 0x90]
call fcn.0041650a
lea eax, [esi + 0x830]
xor edx, edx
mov ecx, eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ecx]
cmp eax, 7
jge 0x40279d
cmp eax, ebx
jl 0x40279d
lea eax, [edx + 1]
cmp edx, 6
mov dword [ebp - 4], eax
jge 0x402788
add ecx, 4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp eax, dword [ecx]
je 0x402788
inc dword [ebp - 4]
add ecx, 4
cmp dword [ebp - 4], 7
jl 0x402773
cmp dword [ebp - 4], 7
jne 0x40279d
mov ecx, dword [ebp - 0xc]
inc edx
add ecx, 4
cmp edx, 7
mov dword [ebp - 0xc], ecx
jl 0x40275a
cmp edx, 7
je 0x4027b5
xor eax, eax
lea ecx, [esi + 0x830]
mov dword [ecx], eax
inc eax
add ecx, 4
cmp eax, 7
jl 0x4027aa
lea eax, [esi + 0x84c]
lea ecx, [ebp - 0x90]
push eax
push 0x42033c
call fcn.00416526
lea eax, [esi + 0x850]
lea ecx, [ebp - 0x90]
push eax
push 0x420330
call fcn.00416526
lea eax, [esi + 0x854]
lea ecx, [ebp - 0x90]
push eax
push 0x420320
call fcn.00416526
lea eax, [esi + 0x858]
lea ecx, [ebp - 0x90]
push eax
push 0x420314
call fcn.00416526
lea eax, [esi + 0x85c]
lea ecx, [ebp - 0x90]
push eax
push 0x420308
call fcn.00416526
lea eax, [esi + 0x860]
lea ecx, [ebp - 0x90]
push eax
push 0x4202fc
call fcn.00416526
lea eax, [esi + 0x864]
lea ecx, [ebp - 0x90]
push eax
push 0x4202f0
call fcn.00416526
lea eax, [esi + 0x868]
lea ecx, [ebp - 0x90]
push eax
push 0x4202e4
call fcn.00416526
lea eax, [esi + 0x86c]
lea ecx, [ebp - 0x90]
push eax
push 0x4202d8
call fcn.00416526
lea eax, [esi + 0x870]
lea ecx, [ebp - 0x90]
push eax
push 0x4202cc
call fcn.00416526
lea eax, [esi + 0x874]
lea ecx, [ebp - 0x90]
push eax
push 0x4202c0
call fcn.00416526
lea ecx, [ebp - 0x90]
call fcn.0041650a
push edi
push 0x4202b8
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x402945
lea eax, [esi + 0x878]
mov ecx, esi
push eax
lea eax, [ebp - 0x90]
push 0x4202ac
push eax
call fcn.00402f04
lea eax, [esi + 0x8b4]
mov ecx, esi
push eax
lea eax, [ebp - 0x90]
push 0x42029c
push eax
call fcn.00402f04
lea eax, [esi + 0x8f0]
mov ecx, esi
push eax
lea eax, [ebp - 0x90]
push 0x420290
push eax
call fcn.00402f04
lea eax, [esi + 0x92c]
mov ecx, esi
push eax
lea eax, [ebp - 0x90]
push 0x420284
push eax
call fcn.00402f04
lea ecx, [ebp - 0x90]
call fcn.0041650a
push edi
push 0x420278
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x4029d5
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
push eax
lea eax, [ebp - 0x15c]
push 0x42058c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x328]
lea ecx, [ebp - 0x90]
push 0xc8
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.004165ed
cmp eax, edi
jne 0x4029ca
test byte [esi + 0x30c], 1
je 0x4029a8
xor eax, eax
jmp 0x4029b5
lea eax, [ebp - 0x328]
push eax
call fcn.0040c4c3
pop ecx
push eax
lea eax, [ebp - 0x328]
push eax
lea ecx, [esi + 0x9bc]
call fcn.00402ece
jmp 0x40295d
lea ecx, [ebp - 0x90]
call fcn.0041650a
cmp dword [0x42007c], ebx
je 0x402a29
mov eax, 0x42007c
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
push 0x140
call fcn.00416ff4
mov ecx, dword [ebp - 0xc]
push 0x32
mov dword [ebp - 0x10], eax
add eax, 8
push dword [ecx]
push eax
call fcn.0040b2aa
mov eax, dword [ebp - 0x10]
lea ecx, [esi + 0x9a0]
add esp, 0x10
mov byte [eax + 0x3a], bl
mov edx, dword [ecx]
push eax
call dword [edx]
mov eax, dword [ebp - 4]
add eax, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
cmp dword [eax], ebx
jne 0x4029e8
push edi
push 0x420268
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x402b39
mov dword [ebp - 4], ebx
push ebx
lea eax, [ebp - 0x15c]
push 0xc8
push eax
push dword [ebp - 4]
lea ecx, [ebp - 0x90]
call fcn.00416722
test eax, eax
jne 0x402a86
lea eax, [ebp - 0x15c]
push 0xc8
push eax
lea ecx, [ebp - 0x90]
push dword [ebp - 4]
call fcn.004166fa
test eax, eax
je 0x402b2e
mov eax, dword [esi + 0x9a0]
lea ecx, [esi + 0x9a0]
call dword [eax + 4]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x402ad3
lea eax, [ebp - 0x15c]
push eax
mov eax, dword [ebp - 8]
add eax, 8
push eax
call fcn.0041a5a0
pop ecx
test eax, eax
pop ecx
je 0x402ace
mov eax, dword [esi + 0x9a0]
push dword [ebp - 8]
lea ecx, [esi + 0x9a0]
call dword [eax + 8]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x402a9c
cmp dword [ebp - 8], ebx
jne 0x402af0
push 0x140
call fcn.00416ff4
mov edx, dword [esi + 0x9a0]
pop ecx
lea ecx, [esi + 0x9a0]
push eax
mov dword [ebp - 8], eax
call dword [edx]
lea eax, [ebp - 0x15c]
push 0x32
push eax
mov eax, dword [ebp - 8]
add eax, 8
push eax
call fcn.0040b2aa
mov eax, dword [ebp - 8]
add esp, 0xc
add eax, 0x3a
lea ecx, [ebp - 0x90]
push 0x104
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.004165ed
inc dword [ebp - 4]
jmp 0x402a45
lea ecx, [ebp - 0x90]
call fcn.0041650a
push edi
push 0x42025c
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x402b81
lea eax, [esi + 0x38]
lea ecx, [ebp - 0x90]
push eax
push 0x420250
call fcn.00416526
lea eax, [esi + 0x3c]
lea ecx, [ebp - 0x90]
push eax
push 0x420240
call fcn.00416526
lea ecx, [ebp - 0x90]
call fcn.0041650a
push edi
push 0x420234
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x402d6e
call fcn.0040c0b5
mov ecx, eax
mov eax, dword [esi + 0x7c8]
cdq
sub eax, edx
mov dword [esi], edi
sar eax, 1
sub ecx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x94], ecx
mov dword [esi + 0x24], edi
mov dword [ebp - 4], ebx
push ebx
lea eax, [ebp - 0x15c]
push 0xc8
push eax
push dword [ebp - 4]
lea ecx, [ebp - 0x90]
call fcn.00416722
test eax, eax
jne 0x402c00
lea eax, [ebp - 0x15c]
push 0xc8
push eax
lea ecx, [ebp - 0x90]
push dword [ebp - 4]
call fcn.004166fa
test eax, eax
je 0x402d52
lea eax, [ebp - 0x15c]
push ebx
push eax
lea ecx, [ebp - 0x90]
call fcn.004164a1
cmp eax, edi
jne 0x402d52
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x90]
push eax
push 0x42025c
call fcn.00416526
cmp eax, edi
jne 0x402d3c
cmp dword [ebp - 0xc], 0xa
je 0x402d3c
push 0xf4
call fcn.00416ff4
cmp eax, ebx
pop ecx
je 0x402c66
lea ecx, [eax + 0xe0]
mov dword [ebp - 8], eax
mov dword [ecx], ebx
mov dword [ecx + 0xc], ebx
mov dword [eax + 0xdc], ebx
jmp 0x402c69
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
push 0x32
push eax
mov dword [eax + 0xd8], ecx
push 0x420228
lea ecx, [ebp - 0x90]
call fcn.004165ed
mov eax, dword [ebp - 8]
push 0x32
add eax, 0x32
lea ecx, [ebp - 0x90]
push eax
push 0x42021c
call fcn.004165ed
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x90]
add eax, 0x64
push eax
push 0x420214
call fcn.00416558
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x90]
add eax, 0x68
push eax
push 0x42020c
call fcn.00416526
mov eax, dword [ebp - 8]
push 0x32
add eax, 0x6c
lea ecx, [ebp - 0x90]
push eax
push 0x420200
call fcn.004165ed
mov eax, dword [ebp - 8]
push 0x32
add eax, 0x9e
lea ecx, [ebp - 0x90]
push eax
push 0x4201f4
call fcn.004165ed
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x90]
add eax, 0xd4
push eax
push 0x4201e8
call fcn.00416558
cmp eax, edi
je 0x402d30
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x94]
add eax, 0xd4
mov dword [eax], ecx
push dword [ebp - 8]
mov ecx, esi
call fcn.0040b6b8
jmp 0x402d3f
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x90]
call fcn.0041650a
inc dword [ebp - 4]
jmp 0x402bbf
lea ecx, [ebp - 0x90]
call fcn.0041650a
cmp dword [ebp - 0x10], ebx
je 0x402d6e
push 0x3000
mov ecx, esi
call fcn.00403066
push edi
push 0x4201e0
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x402e48
lea eax, [esi + 0x2c4]
mov ecx, 0x400
push eax
mov dword [eax], ecx
lea eax, [ebp - 0x728]
mov dword [esi + 0x2d0], ecx
push eax
push 0x4201d4
lea ecx, [ebp - 0x90]
call fcn.00416673
test eax, eax
je 0x402ddd
push dword [esi + 0x2c4]
call fcn.00416ff4
push dword [esi + 0x2c4]
lea ecx, [ebp - 0x728]
mov dword [esi + 0x2c0], eax
push ecx
push eax
call fcn.00417070
add esp, 0x10
lea eax, [esi + 0x2d0]
lea ecx, [ebp - 0x90]
push eax
lea eax, [ebp - 0x728]
push eax
push 0x4201c4
call fcn.00416673
test eax, eax
je 0x402e26
push dword [esi + 0x2d0]
call fcn.00416ff4
mov dword [esi + 0x2cc], eax
push dword [esi + 0x2d0]
lea ecx, [ebp - 0x728]
push ecx
push eax
call fcn.00417070
add esp, 0x10
lea eax, [esi + 0x2c8]
lea ecx, [ebp - 0x90]
push eax
push 0x4201b4
call fcn.00416526
lea ecx, [ebp - 0x90]
call fcn.0041650a
push ebx
push 0x420658
lea ecx, [ebp - 0x90]
call fcn.004164a1
test eax, eax
je 0x402e74
lea ecx, [ebp - 0x90]
call fcn.0041650a
push ebx
lea ecx, [ebp - 0x90]
call fcn.0041674d
lea eax, [ebp - 0x15c]
push 0xc8
push eax
push ebx
lea ecx, [ebp - 0x90]
call fcn.004165ed
cmp eax, edi
jne 0x402ea8
call fcn.004098d1
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.004173b0
pop ecx
test eax, eax
pop ecx
je 0x402ebc
lea ecx, [ebp - 0x90]
call fcn.0041650a
push 0xffffffffffffffff
mov ecx, esi
call fcn.00403066
lea ecx, [ebp - 0x90]
call fcn.0041641e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret