Function at 0x4021f4
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4c59d4
mov eax, dword fs:[0]
push eax
sub esp, 0xde0
mov eax, dword [0x4ea244]
xor eax, esp
mov dword [esp + 0xdd8], eax
push ebx
push esi
push edi
mov eax, dword [0x4ea244]
xor eax, esp
push eax
lea eax, [esp + 0xdf0]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x85c]
push eax
call fcn.00414e42
xor ebx, ebx
mov dword [esp + 0xdf8], ebx
mov eax, dword [esp + 0x85c]
lea ecx, [esp + 0x85c]
mov dword [esp + 0x860], ebx
call dword [eax]
test eax, eax
je 0x4022a9
or dword [esp + 0xdf8], 0xffffffff
lea ecx, [esp + 0x85c]
call fcn.00414ef0
mov eax, 0x80004005
mov ecx, dword [esp + 0xdf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xdd8]
xor ecx, esp
call fcn.0049b726
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x74]
push eax
call fcn.0041bb56
mov byte [esp + 0xdf8], 1
mov eax, dword [esp + 0x74]
lea ecx, [esp + 0x74]
mov dword [esp + 0x78], ebx
call dword [eax]
test eax, eax
je 0x4022df
mov byte [esp + 0xdf8], bl
lea ecx, [esp + 0x74]
call fcn.0041bbb4
jmp 0x40226c
push 7
pop eax
mov dword [esp + 0x7c0], eax
xor ecx, ecx
mov dword [esp + 0x7dc], eax
mov dword [esp + 0x7f8], eax
xor eax, eax
mov dword [esp + 0x7bc], ebx
mov word [esp + 0x7ac], cx
mov dword [esp + 0x7d8], ebx
mov word [esp + 0x7c8], cx
mov dword [esp + 0x7f4], ebx
mov word [esp + 0x7e4], ax
push 0x4cda0c
lea eax, [esp + 0x6fc]
push eax
mov byte [esp + 0xe00], 2
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7b4]
mov byte [esp + 0xe00], 3
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 2
call fcn.0040577a
mov eax, dword [esp + 0x80]
cmp eax, dword [esp + 0x84]
jne 0x4023a9
lea ebx, [esp + 0x7ac]
mov byte [esp + 0xdf8], 1
call fcn.0040431d
mov byte [esp + 0xdf8], 0
jmp 0x4022d4
push 0x4cda14
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 4
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 2
call fcn.0040577a
mov eax, dword [esp + 0x80]
mov eax, dword [eax]
push 0xffffffffffffffff
add eax, 8
push ebx
lea ecx, [esp + 0x7ec]
call fcn.00405642
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x7ac]
call fcn.00404e59
push 0x4cda24
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 5
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 2
call fcn.0040577a
lea eax, [esp + 0x714]
push eax
call fcn.0040595a
mov byte [esp + 0xdf8], 7
mov eax, dword [esp + 0x80]
mov eax, dword [eax]
push dword [eax + 0x80]
lea eax, [esp + 0x718]
push eax
call fcn.00406d9c
lea edx, [esp + 0x6f8]
lea ecx, [esp + 0x714]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xe00], 8
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 7
call fcn.0040577a
lea ecx, [esp + 0x764]
mov byte [esp + 0xdf8], 2
call fcn.00404f28
lea eax, [esp + 0x764]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x764], 0x4cddd8
mov byte [esp + 0xdf8], 2
push eax
mov dword [esp + 0x768], 0x4cddd0
call fcn.0049b506
pop ecx
lea ecx, [esp + 0x7ac]
mov esi, dword [esp + 0x14]
call fcn.00404e59
xor eax, eax
mov dword [esp + 0x854], 7
mov dword [esp + 0x850], ebx
mov word [esp + 0x840], ax
lea ecx, [esp + 0x840]
mov byte [esp + 0xdf8], 0xb
call fcn.0041fd44
push 0x4cda30
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0xc
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0xb
call fcn.0040577a
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x848]
lea ecx, [esp + 0x7ec]
call fcn.00405642
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x7ac]
call fcn.00404e59
push 0x4cda44
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0xd
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0xb
call fcn.0040577a
call dword [0x4c7194]
movzx esi, ax
lea eax, [esp + 0x714]
push eax
call fcn.0040595a
push esi
lea eax, [esp + 0x718]
push eax
mov byte [esp + 0xe00], 0xf
call fcn.00406ca1
lea edx, [esp + 0x6f8]
lea ecx, [esp + 0x714]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xe00], 0x10
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0xf
call fcn.0040577a
lea ecx, [esp + 0x764]
mov byte [esp + 0xdf8], 0xb
call fcn.00404f28
lea eax, [esp + 0x764]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x764], 0x4cddd8
mov byte [esp + 0xdf8], 0xb
push eax
mov dword [esp + 0x768], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x7ac]
call fcn.00404e59
lea eax, [esp + 0x6d4]
push eax
call dword [0x4c7190]
push 0x4cda70
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0x13
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0xb
call fcn.0040577a
call fcn.004107f8
push eax
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xe00], 0x14
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0xb
call fcn.0040577a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x7ac]
call fcn.00404e59
lea eax, [esp + 0xccc]
push eax
mov dword [esp + 0xcd0], 0x114
call dword [0x4c718c]
test eax, eax
jne 0x402801
mov dword [esp + 0x20], 0x80004005
push 1
xor edi, edi
lea esi, [esp + 0x844]
mov byte [esp + 0xdfc], 2
call fcn.0040577a
lea ebx, [esp + 0x7ac]
mov byte [esp + 0xdf8], 1
call fcn.0040431d
lea ecx, [esp + 0x74]
mov byte [esp + 0xdf8], 0
call fcn.0041bbb4
or dword [esp + 0xdf8], 0xffffffff
lea ecx, [esp + 0x85c]
call fcn.00414ef0
mov eax, dword [esp + 0x20]
jmp 0x402285
push 0x4cda9c
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0x15
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0xb
call fcn.0040577a
lea eax, [esp + 0x714]
push eax
call fcn.0040595a
mov byte [esp + 0xdf8], 0x17
push dword [esp + 0xcd0]
lea eax, [esp + 0x718]
push eax
call fcn.00406d9c
lea eax, [esp + 0x714]
push 0x2e
push eax
call fcn.004081f2
pop ecx
pop ecx
push dword [esp + 0xcd4]
lea eax, [esp + 0x718]
push eax
call fcn.00406d9c
lea edx, [esp + 0x6f8]
lea ecx, [esp + 0x714]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xe00], 0x18
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x17
call fcn.0040577a
lea ecx, [esp + 0x764]
mov byte [esp + 0xdf8], 0xb
call fcn.00404f28
lea eax, [esp + 0x764]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x764], 0x4cddd8
mov byte [esp + 0xdf8], 0xb
push eax
mov dword [esp + 0x768], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x7ac]
call fcn.00404e59
xor eax, eax
mov dword [esp + 0x838], 7
mov dword [esp + 0x834], ebx
mov word [esp + 0x824], ax
lea esi, [esp + 0x824]
mov byte [esp + 0xdf8], 0x1b
call fcn.00402120
test al, al
je 0x4029d2
push 0x4cdab0
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0x1c
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x1b
call fcn.0040577a
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x82c]
lea ecx, [esp + 0x7ec]
call fcn.00405642
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x7ac]
call fcn.00404e59
mov eax, dword [esp + 0x894]
mov dword [esp + 0x20], eax
cmp eax, ebx
je 0x402b3a
push 0x4cdac0
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0x1d
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x1b
call fcn.0040577a
mov eax, dword [esp + 0x20]
push 0x64
pop ecx
xor edx, edx
div ecx
mov esi, eax
lea eax, [esp + 0x714]
push eax
mov edi, edx
call fcn.0040595a
push esi
lea eax, [esp + 0x718]
push eax
mov byte [esp + 0xe00], 0x1f
call fcn.00406d9c
lea eax, [esp + 0x714]
push 0x2e
push eax
call fcn.004081f2
push ebx
lea eax, [esp + 0x48]
push 2
push eax
call fcn.0049b61a
add esp, 0x14
mov ecx, eax
lea esi, [esp + 0x714]
call fcn.00406be8
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push edi
push esi
mov word [eax + esi + 0x40], cx
call fcn.00406d9c
lea edx, [esp + 0x6f8]
mov ecx, esi
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xe00], 0x20
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x1f
call fcn.0040577a
lea ecx, [esp + 0x764]
mov byte [esp + 0xdf8], 0x1b
call fcn.00404f28
lea eax, [esp + 0x764]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x764], 0x4cddd8
mov byte [esp + 0xdf8], 0x1b
mov dword [esp + 0x764], 0x4cddd0
push eax
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x7ac]
call fcn.00404e59
push 0x4cdadc
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0x23
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x1b
call fcn.0040577a
mov eax, dword [esp + 0x888]
mov ecx, dword [esp + 0x884]
sub eax, ecx
push 0x1c
cdq
pop edi
idiv edi
xor esi, esi
cmp eax, ebx
jbe 0x402bb1
add ecx, 0x14
cmp byte [ecx], bl
jne 0x403890
inc esi
add ecx, 0x1c
cmp esi, eax
jb 0x402ba1
mov eax, 0x4cdb08
push eax
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xe00], 0x24
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x1b
call fcn.0040577a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x7ac]
call fcn.00404e59
push 0x4cdb0c
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0x25
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x1b
call fcn.0040577a
call fcn.004020cd
test al, al
mov eax, 0x4cd94c
jne 0x402c63
mov eax, 0x4cdb08
push eax
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xe00], 0x26
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x1b
call fcn.0040577a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x7ac]
call fcn.00404e59
lea eax, [esp + 0xc8c]
push eax
mov dword [esp + 0xc90], 0x40
call dword [0x4c7188]
test eax, eax
je 0x402de9
push 0x4cdb20
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0x27
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x1b
call fcn.0040577a
lea eax, [esp + 0x714]
push eax
call fcn.0040595a
mov byte [esp + 0xdf8], 0x29
push dword [esp + 0xc98]
lea eax, [esp + 0x718]
push dword [esp + 0xc98]
push eax
call fcn.00406e90
lea edx, [esp + 0x6f8]
lea ecx, [esp + 0x714]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xe00], 0x2a
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x29
call fcn.0040577a
lea ecx, [esp + 0x764]
mov byte [esp + 0xdf8], 0x1b
call fcn.00404f28
lea eax, [esp + 0x764]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x764], 0x4cddd8
mov byte [esp + 0xdf8], 0x1b
push eax
mov dword [esp + 0x768], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x7ac]
call fcn.00404e59
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
call fcn.004021a1
pop ecx
test al, al
je 0x402f5d
push 0x4cdb48
lea eax, [esp + 0x6fc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7d0]
mov byte [esp + 0xe00], 0x2d
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x1b
call fcn.0040577a
lea eax, [esp + 0x714]
push eax
call fcn.0040595a
mov byte [esp + 0xdf8], 0x2f
push dword [esp + 0x20]
lea eax, [esp + 0x718]
push eax
call fcn.00406d9c
lea eax, [esp + 0x714]
push 0x78
push eax
call fcn.004081f2
pop ecx
pop ecx
push dword [esp + 0x28]
lea eax, [esp + 0x718]
push eax
call fcn.00406d9c
lea eax, [esp + 0x714]
push 0x40
push eax
call fcn.004081f2
pop ecx
pop ecx
push dword [esp + 0x1c]
lea eax, [esp + 0x718]
push eax
call fcn.00406d9c
lea edx, [esp + 0x6f8]
lea ecx, [esp + 0x714]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x700]
lea ecx, [esp + 0x7ec]
mov byte [esp + 0xe00], 0x30
call fcn.00405642
push 1
lea esi, [esp + 0x6fc]
mov byte [esp + 0xdfc], 0x2f
call fcn.0040577a
lea ecx, [esp + 0x764]
mov byte [esp + 0xdf8], 0x1b
call fcn.00404f28
lea eax, [esp + 0x764]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x764], 0x4cddd8
mov byte [esp + 0xdf8], 0x1b
push eax
mov dword [esp + 0x768], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x7ac]
call fcn.00404e59
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x878]
call fcn.00404d42
mov byte [esp + 0xdf8], 0x33
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
sub eax, ecx
sar eax, 2
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], eax
cmp eax, ebx
jbe 0x4042d8
lea eax, [esp + 0x134]
mov dword [esp + 0x64], eax
lea eax, [esp + 0x394]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x1cc]
mov dword [esp + 0x50], eax
lea eax, [esp + 0x2fc]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x42c]
mov dword [esp + 0x68], eax
lea eax, [esp + 0x68c]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x5f4]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x55c]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x4c4]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x18], ecx
push 7
pop eax
mov dword [esp + 0x728], eax
xor ecx, ecx
mov dword [esp + 0x744], eax
mov dword [esp + 0x760], eax
xor eax, eax
mov dword [esp + 0x724], ebx
mov word [esp + 0x714], cx
mov dword [esp + 0x740], ebx
mov word [esp + 0x730], cx
mov dword [esp + 0x75c], ebx
mov word [esp + 0x74c], ax
lea eax, [esp + 0xe4]
push eax
mov byte [esp + 0xdfc], 0x34
call fcn.0040595a
mov byte [esp + 0xdf8], 0x36
push dword [esp + 0x20]
lea eax, [esp + 0xe8]
push eax
call fcn.00406d9c
lea edx, [esp + 0xb90]
lea ecx, [esp + 0xe4]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb98]
lea ecx, [esp + 0x71c]
mov byte [esp + 0xe00], 0x37
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0xb94]
mov byte [esp + 0xdfc], 0x36
call fcn.0040577a
lea ecx, [esp + 0x134]
mov byte [esp + 0xdf8], 0x34
call fcn.00404f28
mov dword [esp + 0x134], 0x4cddd8
lea eax, [esp + 0x134]
mov byte [esp + 0xdf8], 0x34
push eax
mov dword [esp + 0x138], 0x4cddd0
call fcn.0049b506
lea eax, [esp + 0x92c]
mov dword [esp], 0x4cdb6c
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x930]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x3a
call fcn.00405642
push 1
lea esi, [esp + 0x92c]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
push 0xffffffffffffffff
add eax, 8
push ebx
lea ecx, [esp + 0x754]
call fcn.00405642
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x714]
call fcn.00404e59
mov eax, dword [edi]
push dword [eax + 0x6bc]
call fcn.0040d563
mov dword [esp + 0x2c], eax
mov dword [esp], 0x4cdb84
lea eax, [esp + 0x964]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x968]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x3b
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x964]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov eax, dword [esp + 0x28]
lea esi, [esp + 0xc38]
call fcn.0040207a
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x3c
call fcn.00405642
push 1
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdb98
lea eax, [esp + 0x99c]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x9a0]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x3d
call fcn.00405642
push 1
lea esi, [esp + 0x99c]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
lea eax, [esp + 0x344]
push eax
call fcn.0040595a
mov eax, dword [esp + 0x18]
mov byte [esp + 0xdf8], 0x3f
mov eax, dword [eax]
push dword [eax + 0xbc]
lea eax, [esp + 0x348]
push eax
call fcn.00406d9c
lea edx, [esp + 0x9d0]
lea ecx, [esp + 0x344]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x9d8]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x40
call fcn.00405642
push 1
lea esi, [esp + 0x9d4]
mov byte [esp + 0xdfc], 0x3f
call fcn.0040577a
lea ecx, [esp + 0x394]
mov byte [esp + 0xdf8], 0x34
call fcn.00404f28
mov dword [esp + 0x394], 0x4cddd8
lea eax, [esp + 0x394]
mov byte [esp + 0xdf8], 0x34
mov dword [esp + 0x394], 0x4cddd0
push eax
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdbac
lea eax, [esp + 0xa0c]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xa10]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x43
call fcn.00405642
push 1
lea esi, [esp + 0xa0c]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
lea eax, [esp + 0x17c]
push eax
call fcn.0040595a
mov eax, dword [esp + 0x18]
mov byte [esp + 0xdf8], 0x45
mov eax, dword [eax]
push dword [eax + 0x9c]
lea eax, [esp + 0x180]
push eax
call fcn.00406d9c
lea edx, [esp + 0xa40]
lea ecx, [esp + 0x17c]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xa48]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x46
call fcn.00405642
push 1
lea esi, [esp + 0xa44]
mov byte [esp + 0xdfc], 0x45
call fcn.0040577a
lea ecx, [esp + 0x1cc]
mov byte [esp + 0xdf8], 0x34
call fcn.00404f28
mov dword [esp + 0x1cc], 0x4cddd8
lea eax, [esp + 0x1cc]
mov byte [esp + 0xdf8], 0x34
push eax
mov dword [esp + 0x1d0], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdbcc
lea eax, [esp + 0xa7c]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xa80]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x49
call fcn.00405642
push 1
lea esi, [esp + 0xa7c]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov eax, dword [eax + 0x610]
lea esi, [esp + 0xc70]
call fcn.00401f94
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x4a
call fcn.00405642
push 1
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdbe4
lea eax, [esp + 0xab4]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xab8]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x4b
call fcn.00405642
push 1
lea esi, [esp + 0xab4]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
lea eax, [esp + 0x2ac]
push eax
call fcn.0040595a
mov eax, dword [esp + 0x18]
mov byte [esp + 0xdf8], 0x4d
mov eax, dword [eax]
push dword [eax + 0x94]
lea eax, [esp + 0x2b0]
push eax
call fcn.00406d9c
lea edx, [esp + 0xae8]
lea ecx, [esp + 0x2ac]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xaf0]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x4e
call fcn.00405642
push 1
lea esi, [esp + 0xaec]
mov byte [esp + 0xdfc], 0x4d
call fcn.0040577a
lea ecx, [esp + 0x2fc]
mov byte [esp + 0xdf8], 0x34
call fcn.00404f28
mov dword [esp + 0x2fc], 0x4cddd8
lea eax, [esp + 0x2fc]
mov byte [esp + 0xdf8], 0x34
push eax
mov dword [esp + 0x300], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdbf8
lea eax, [esp + 0xb24]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb28]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x51
call fcn.00405642
mov byte [esp + 0xdf8], 0x34
push 1
lea esi, [esp + 0xb24]
call fcn.0040577a
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov eax, dword [eax + 0x60c]
lea esi, [esp + 0xc1c]
call fcn.00402010
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x52
call fcn.00405642
push 1
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdc10
lea eax, [esp + 0xb5c]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb60]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x53
call fcn.00405642
push 1
lea esi, [esp + 0xb5c]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov eax, dword [eax + 0x63c]
lea esi, [esp + 0xc54]
call fcn.0040204f
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x54
call fcn.00405642
push 1
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdc30
lea eax, [esp + 0x8bc]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x8c0]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x55
call fcn.00405642
push 1
lea esi, [esp + 0x8bc]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
lea eax, [esp + 0x3dc]
push eax
call fcn.0040595a
mov eax, dword [esp + 0x18]
mov byte [esp + 0xdf8], 0x57
mov eax, dword [eax]
lea ecx, [eax + 0x620]
mov edx, dword [ecx]
add eax, 0x640
cmp edx, dword [eax]
jae 0x40375b
mov eax, ecx
push dword [eax]
lea eax, [esp + 0x3e0]
push eax
call fcn.00406d9c
lea edx, [esp + 0xbc8]
lea ecx, [esp + 0x3dc]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xbd0]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x58
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0xbcc]
mov byte [esp + 0xdfc], 0x57
call fcn.0040577a
lea ecx, [esp + 0x42c]
mov byte [esp + 0xdf8], 0x34
call fcn.00404f28
mov dword [esp + 0x42c], 0x4cddd8
lea eax, [esp + 0x42c]
mov byte [esp + 0xdf8], 0x34
push eax
mov dword [esp + 0x430], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdc44
lea eax, [esp + 0xc04]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xc08]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x5b
call fcn.00405642
push 1
lea esi, [esp + 0xc04]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov edi, dword [esp + 0x18]
mov eax, dword [edi]
push 0xffffffffffffffff
add eax, 0x78
push ebx
lea ecx, [esp + 0x754]
call fcn.00405642
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x714]
call fcn.00404e59
mov eax, dword [edi]
mov ecx, dword [eax + 0x170c]
sub ecx, dword [eax + 0x1708]
mov dword [esp + 0x1c], ebx
sar ecx, 2
test ecx, ecx
je 0x403ac1
jmp 0x40389e
mov eax, 0x4cd94c
jmp 0x402bb6
mov edi, dword [esp + 0x18]
push 7
pop ecx
xor eax, eax
mov dword [esp + 0x81c], ecx
mov dword [esp + 0x818], ebx
mov word [esp + 0x808], ax
mov byte [esp + 0xdf8], 0x5c
mov edx, dword [edi]
mov eax, dword [esp + 0x1c]
mov edx, dword [edx + 0x1708]
mov eax, dword [edx + eax*4]
mov eax, dword [eax]
cmp eax, ebx
je 0x403955
cmp eax, 4
je 0x40391c
cmp eax, ecx
jne 0x403a86
push 0x4cdc60
lea eax, [esp + 0xb40]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb44]
lea ecx, [esp + 0x810]
mov byte [esp + 0xe00], 0x5d
call fcn.00405642
lea esi, [esp + 0xb3c]
jmp 0x40398c
push 0x4cdca0
lea eax, [esp + 0x8f4]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x8f8]
lea ecx, [esp + 0x810]
mov byte [esp + 0xe00], 0x5f
call fcn.00405642
lea esi, [esp + 0x8f0]
jmp 0x40398c
push 0x4cdc80
lea eax, [esp + 0x910]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x914]
lea ecx, [esp + 0x810]
mov byte [esp + 0xe00], 0x5e
call fcn.00405642
lea esi, [esp + 0x90c]
push 1
xor edi, edi
mov byte [esp + 0xdfc], 0x5c
call fcn.0040577a
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x810]
lea ecx, [esp + 0x738]
call fcn.00405642
lea eax, [esp + 0x214]
push eax
call fcn.0040595a
mov eax, dword [esp + 0x18]
mov byte [esp + 0xdf8], 0x61
mov eax, dword [eax]
mov eax, dword [eax + 0x1708]
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + ecx*4]
push dword [eax + 4]
lea eax, [esp + 0x218]
push eax
call fcn.00406d9c
lea edx, [esp + 0xa94]
lea ecx, [esp + 0x214]
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xa9c]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x62
call fcn.00405642
push 1
lea esi, [esp + 0xa98]
mov byte [esp + 0xdfc], 0x61
call fcn.0040577a
lea ecx, [esp + 0x264]
mov byte [esp + 0xdf8], 0x5c
call fcn.00404f28
lea eax, [esp + 0x264]
mov dword [esp + 0x28], eax
mov dword [esp + 0x264], 0x4cddd8
mov byte [esp + 0xdf8], 0x5c
push eax
mov dword [esp + 0x268], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x714]
call fcn.00404e59
push 1
xor edi, edi
lea esi, [esp + 0x80c]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov ecx, dword [eax + 0x170c]
sub ecx, dword [eax + 0x1708]
inc dword [esp + 0x1c]
sar ecx, 2
cmp dword [esp + 0x1c], ecx
jb 0x40389a
push 0x4cdcbc
lea eax, [esp + 0x948]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x94c]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x65
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x948]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
cmp byte [eax + 0xec], bl
mov eax, 0x4cd94c
jne 0x403b21
mov eax, 0x4cdb08
push eax
lea eax, [esp + 0xbb0]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xbb4]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x66
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0xbb0]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x714]
call fcn.00404e59
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov cx, word [eax + 0xde]
mov word [esp + 0x30], cx
mov cx, word [eax + 0xdc]
mov word [esp + 0x32], cx
mov cx, word [eax + 0xe2]
mov ax, word [eax + 0xe0]
mov word [esp + 0x36], ax
push 0x4cdcd0
lea eax, [esp + 0x980]
push eax
mov word [esp + 0x3c], cx
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x984]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x67
call fcn.00405642
push 1
lea esi, [esp + 0x980]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
lea eax, [esp + 0x63c]
push eax
call fcn.0040595a
push ebx
lea eax, [esp + 0xd8]
push 4
push eax
mov byte [esp + 0xe04], 0x69
call fcn.0049b61a
add esp, 0xc
mov ecx, eax
lea esi, [esp + 0x63c]
call fcn.00406be8
mov esi, eax
cmp esi, ebx
jne 0x403c31
xor eax, eax
jmp 0x403c38
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push dword [esp + 0x30]
mov word [eax + esi + 0x40], cx
push esi
call fcn.00406ca1
lea edx, [esp + 0xacc]
mov ecx, esi
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xad4]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x6a
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0xad0]
mov byte [esp + 0xdfc], 0x69
call fcn.0040577a
lea ecx, [esp + 0x68c]
mov byte [esp + 0xdf8], 0x34
call fcn.00404f28
mov dword [esp + 0x68c], 0x4cddd8
lea eax, [esp + 0x68c]
mov byte [esp + 0xdf8], 0x34
push eax
mov dword [esp + 0x690], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdce4
lea eax, [esp + 0x9b8]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x9bc]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x6d
call fcn.00405642
push 1
lea esi, [esp + 0x9b8]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
lea eax, [esp + 0x5a4]
push eax
call fcn.0040595a
push ebx
lea eax, [esp + 0xc8]
push 4
push eax
mov byte [esp + 0xe04], 0x6f
call fcn.0049b61a
add esp, 0xc
mov ecx, eax
lea esi, [esp + 0x5a4]
call fcn.00406be8
mov esi, eax
cmp esi, ebx
jne 0x403d7b
xor eax, eax
jmp 0x403d82
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push dword [esp + 0x32]
mov word [eax + esi + 0x40], cx
push esi
call fcn.00406ca1
lea edx, [esp + 0xb74]
mov ecx, esi
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb7c]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x70
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0xb78]
mov byte [esp + 0xdfc], 0x6f
call fcn.0040577a
lea ecx, [esp + 0x5f4]
mov byte [esp + 0xdf8], 0x34
call fcn.00404f28
mov dword [esp + 0x5f4], 0x4cddd8
lea eax, [esp + 0x5f4]
mov byte [esp + 0xdf8], 0x34
push eax
mov dword [esp + 0x5f8], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdcf8
lea eax, [esp + 0x9f0]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x9f4]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x73
call fcn.00405642
push 1
lea esi, [esp + 0x9f0]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
lea eax, [esp + 0x50c]
push eax
call fcn.0040595a
push ebx
lea eax, [esp + 0xa8]
push 4
push eax
mov byte [esp + 0xe04], 0x75
call fcn.0049b61a
add esp, 0xc
mov ecx, eax
lea esi, [esp + 0x50c]
call fcn.00406be8
mov esi, eax
cmp esi, ebx
jne 0x403ec5
xor eax, eax
jmp 0x403ecc
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push dword [esp + 0x34]
mov word [eax + esi + 0x40], cx
push esi
call fcn.00406ca1
lea edx, [esp + 0xb04]
mov ecx, esi
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xb0c]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x76
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0xb08]
mov byte [esp + 0xdfc], 0x75
call fcn.0040577a
lea ecx, [esp + 0x55c]
mov byte [esp + 0xdf8], 0x34
call fcn.00404f28
mov dword [esp + 0x55c], 0x4cddd8
lea eax, [esp + 0x55c]
mov byte [esp + 0xdf8], 0x34
push eax
mov dword [esp + 0x560], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x714]
call fcn.00404e59
push 0x4cdd10
lea eax, [esp + 0xa28]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xa2c]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x79
call fcn.00405642
push 1
lea esi, [esp + 0xa28]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
lea eax, [esp + 0x474]
push eax
call fcn.0040595a
push ebx
lea eax, [esp + 0xb8]
push 4
push eax
mov byte [esp + 0xe04], 0x7b
call fcn.0049b61a
add esp, 0xc
mov ecx, eax
lea esi, [esp + 0x474]
call fcn.00406be8
mov esi, eax
cmp esi, ebx
jne 0x40400f
xor eax, eax
jmp 0x404016
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, 0x800
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push dword [esp + 0x36]
mov word [eax + esi + 0x40], cx
push esi
call fcn.00406ca1
lea edx, [esp + 0xbe4]
mov ecx, esi
call fcn.00404eea
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xbec]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x7c
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0xbe8]
mov byte [esp + 0xdfc], 0x7b
call fcn.0040577a
lea ecx, [esp + 0x4c4]
mov byte [esp + 0xdf8], 0x34
call fcn.00404f28
mov dword [esp + 0x4c4], 0x4cddd8
lea eax, [esp + 0x4c4]
mov byte [esp + 0xdf8], 0x34
push eax
mov dword [esp + 0x4c8], 0x4cddd0
call fcn.0049b506
mov esi, dword [esp + 0x18]
pop ecx
lea ecx, [esp + 0x714]
call fcn.00404e59
mov eax, dword [esp + 0x868]
mov ecx, dword [esp + 0x864]
sub eax, ecx
sar eax, 2
mov byte [esp + 0x27], bl
mov dword [esp + 0x1c], ebx
test eax, eax
je 0x4041ff
mov eax, dword [esp + 0x1c]
lea ecx, [ecx + eax*4]
mov eax, dword [esp + 0x18]
mov eax, dword [eax]
mov ecx, dword [ecx]
add eax, 0x40
add ecx, 0xc
call fcn.00406c23
test al, al
je 0x4041d2
mov eax, dword [esp + 0x864]
mov ecx, dword [esp + 0x1c]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xf0]
sub edx, dword [eax + 0xec]
mov dword [esp + 0x28], ebx
sar edx, 2
test edx, edx
je 0x4041d2
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
mov ecx, dword [esp + 0x28]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, 0x54
push eax
lea esi, [esp + 0x6fc]
call fcn.00404346
mov esi, 0x4cdd28
push esi
mov byte [esp + 0xdfc], 0x7f
call fcn.0049bca8
pop ecx
push eax
push esi
xor eax, eax
lea ecx, [esp + 0x700]
call fcn.004056dc
xor edi, edi
mov byte [esp + 0xdf8], 0x34
push 1
lea esi, [esp + 0x6fc]
cmp eax, 0xffffffff
jne 0x4041f5
call fcn.0040577a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x864]
inc dword [esp + 0x28]
lea ecx, [ecx + eax*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xf0]
sub edx, dword [eax + 0xec]
sar edx, 2
cmp dword [esp + 0x28], edx
jb 0x404143
mov eax, dword [esp + 0x868]
mov ecx, dword [esp + 0x864]
inc dword [esp + 0x1c]
sub eax, ecx
sar eax, 2
cmp dword [esp + 0x1c], eax
jb 0x4040f6
jmp 0x4041ff
mov byte [esp + 0x2b], 1
call fcn.0040577a
push 0x4cdd38
lea eax, [esp + 0xa60]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xa64]
lea ecx, [esp + 0x738]
mov byte [esp + 0xe00], 0x80
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0xa60]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov eax, 0x4cd94c
cmp byte [esp + 0x27], bl
jne 0x404257
mov eax, 0x4cdb08
push eax
lea eax, [esp + 0x8d8]
push eax
call fcn.00404b77
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x8dc]
lea ecx, [esp + 0x754]
mov byte [esp + 0xe00], 0x81
call fcn.00405642
push 1
xor edi, edi
lea esi, [esp + 0x8d8]
mov byte [esp + 0xdfc], 0x34
call fcn.0040577a
mov esi, dword [esp + 0x14]
lea ecx, [esp + 0x714]
call fcn.00404e59
lea ebx, [esp + 0x714]
mov byte [esp + 0xdf8], 0x33
call fcn.0040431d
inc dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x18], 4
xor ebx, ebx
cmp eax, dword [esp + 0x2c]
jb 0x402ffa
mov byte [esp + 0xdf8], 0x1b
cmp dword [esp + 0x3c], ebx
je 0x4042f0
push dword [esp + 0x3c]
call fcn.0049b71b
pop ecx
push 1
xor edi, edi
lea esi, [esp + 0x828]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov byte [esp + 0xdfc], 0xb
call fcn.0040577a
mov dword [esp + 0x20], ebx
jmp 0x4027a7