Function at 0x404120
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x460e96
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2e844
call fcn.004538f0
mov eax, dword [0x46bee0]
xor eax, esp
mov dword [esp + 0x2e840], eax
push ebx
push esi
push edi
mov eax, dword [0x46bee0]
xor eax, esp
push eax
lea eax, [esp + 0x2e858]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, ecx
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
cmp word [eax + 0x73b0], si
je 0x404194
mov dword [eax + 0x6160], esi
mov dword [eax + 0x6164], esi
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x1010], si
je 0x404200
push 0x464494
push edi
call fcn.00431910
test al, al
jne 0x404200
push 0x46448c
push edi
call fcn.00431910
test al, al
jne 0x404200
push 0x464484
push edi
call fcn.00431910
test al, al
jne 0x4041fa
mov eax, edi
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x4041d2
mov ecx, dword [str..ext]
mov dword [eax], ecx
mov edx, dword [0x46447c]
mov dword [eax + 4], edx
mov cx, word [0x464480]
mov word [eax + 8], cx
push edi
call fcn.00432c70
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x61b0], 0
je 0x40421e
mov edx, dword [ebp + 0xc]
push 1
add eax, 0x61b2
push eax
push edx
push edi
call fcn.00432850
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x6198], 0
je 0x404230
push edi
call fcn.00423990
mov eax, dword [ebx + 0x38]
xor ecx, ecx
mov word [esp + 0x2d7cc], cx
mov ecx, dword [eax + 0x6160]
xor edx, edx
or ecx, dword [eax + 0x6164]
mov word [esp + 0x2d84c], dx
je 0x40425e
mov byte [ebx + 0x18e6], 1
jmp 0x404265
and dword [eax + 0x6148], 0xffffffe7
cmp byte [0x46ce88], 0
jne 0x404281
push 0xd28
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 4
mov eax, dword [ebx + 0x38]
movzx edx, byte [eax + 0x6189]
mov ecx, dword [eax + 0x615c]
push 1
push edx
push ecx
add eax, 0xa3e4
push eax
lea ecx, [esp + 0x1b0b4]
mov byte [esp + 0x26], 0
call fcn.00442c20
mov edx, dword [esp + 0x30]
push 0x800
push edx
lea eax, [esp + 0x1e0d0]
xor edi, edi
push eax
mov dword [esp + 0x2e86c], edi
call fcn.00446010
mov ecx, dword [ebx + 0x38]
mov dword [esp + 0x1f0c8], ecx
lea ecx, [esp + 0x31cc]
call fcn.00447310
lea ecx, [esp + 0x31d4]
call fcn.00447310
lea ecx, [esp + 0x31dc]
call fcn.00447310
mov edx, dword [ebx + 0x38]
push edx
lea ecx, [esp + 0xc8]
call fcn.00406f10
mov eax, dword [ebx + 0x38]
lea esi, [eax + 0x73b0]
mov byte [esp + 0x2e860], 1
cmp word [esi], di
je 0x4043c9
push 0x50
lea eax, [esp + 0x58]
push edi
push eax
call fcn.00453e70
add esp, 0xc
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], esi
mov dword [esp + 0x80], 2
mov dword [esp + 0x9c], 0xffffffff
call fcn.00447310
lea ecx, [esp + 0x3c]
call fcn.00447260
lea ecx, [esp + 0x3c]
call fcn.00447240
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0xc8]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
call fcn.00406ab0
mov esi, dword [esp + 0x30]
cmp dword [esp + 0x1c0bc], 0
je 0x40454f
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x62b2], 0
je 0x404543
push 0xe50
call fcn.00440940
push eax
push esi
call fcn.004183e0
add esp, 8
push 6
mov ecx, 0x47f1a0
call fcn.0041d030
jmp 0x40454f
lea edx, [esp + 0x21bc]
push edx
lea ecx, [esp + 0x1b0a8]
call fcn.004434d0
test eax, eax
jne 0x404382
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x130]
push edi
push eax
lea ecx, [esp + 0x21c4]
push ecx
push esi
mov ecx, ebx
call fcn.00401490
test al, al
je 0x404522
push 0x50
lea edx, [esp + 0x58]
push 0
push edx
call fcn.00453e70
mov ecx, dword [esp + 0x31c8]
mov edx, dword [esp + 0x31cc]
lea eax, [esp + 0x21c8]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x31d0]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x31d4]
or byte [esp + 0x22], ah
mov dword [esp + 0x68], ecx
add esp, 0xc
lea ecx, [esp + 0x31cc]
mov dword [esp + 0x60], edx
mov byte [esp + 0xa0], al
mov byte [esp + 0xa1], ah
call fcn.00447240
lea ecx, [esp + 0x31dc]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
call fcn.00447240
movzx ecx, word [esp + 0x1e0c4]
mov dword [esp + 0x78], edx
lea edx, [esp + 0x21bc]
mov dword [esp + 0x7c], ecx
mov ecx, dword [ebx + 0x38]
push edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x84], 2
mov dword [esp + 0xa0], 0xffffffff
call fcn.00414310
test al, al
je 0x4044c2
or dword [esp + 0x94], 1
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xa454], 0
jbe 0x404506
push 0x800
lea ecx, [esp + 0x1198]
push ecx
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00401560
mov eax, dword [esp + 0x31c8]
push 0
push 0
push eax
lea ecx, [esp + 0x11a0]
push ecx
mov ecx, dword [ebx + 0x38]
call fcn.00414bc0
test al, al
jne 0x404522
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0xc8]
call fcn.00406ab0
cmp byte [esp + 0x31c8], 0
jne 0x404522
inc edi
lea eax, [esp + 0x21bc]
push eax
lea ecx, [esp + 0x1b0a8]
call fcn.004434d0
test eax, eax
je 0x4043e5
jmp 0x404386
push 6
mov ecx, 0x47f1a0
call fcn.0041cd40
lea ecx, [esp + 0xc4]
call fcn.00406f40
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x61a0]
cmp ecx, 3
je 0x406543
cmp ecx, 4
je 0x40653e
push eax
lea ecx, [esp + 0xf158]
call fcn.00409a40
mov edx, dword [ebx + 0x38]
push edx
lea ecx, [esp + 0x3208]
mov byte [esp + 0x2e864], 2
call fcn.00409a40
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x5126], 0
mov byte [esp + 0x2e860], 3
je 0x4045c0
cmp byte [eax + 0x5124], 0
mov byte [esp + 0xe110], 1
jne 0x4045c8
mov byte [esp + 0xe110], 0
mov ecx, dword [eax + 0x73ac]
mov edx, dword [eax + 0x73a8]
mov eax, dword [eax + 0x73a4]
push ecx
push edx
push eax
lea ecx, [esp + 0x3210]
call fcn.004074c0
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6195]
neg edx
sbb edx, edx
and edx, 3
mov edi, 1
add edx, edi
push edx
push esi
lea ecx, [esp + 0xf15c]
call fcn.00421a40
test al, al
je 0x404732
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x6160]
or ecx, dword [eax + 0x6164]
jne 0x40464c
cmp byte [esp + 0x1a058], cl
jne 0x404639
cmp dword [eax + 0x6148], ecx
jne 0x40464c
cmp byte [eax + 0x6197], 0
je 0x40469e
cmp dword [esp + 0x1a054], 2
jne 0x40469e
lea ecx, [esp + 0xf154]
call fcn.00422370
cmp eax, 0x14
jne 0x404679
test edx, edx
jne 0x404679
lea ecx, [esp + 0xf154]
call fcn.00421d60
mov dword [esp + 0x10174], edi
jmp 0x40473f
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x6160]
or edx, dword [eax + 0x6164]
je 0x40469e
xor ecx, ecx
mov dword [eax + 0x6160], ecx
mov dword [eax + 0x6164], ecx
mov byte [ebx + 0x18e6], cl
push 0
lea ecx, [esp + 0xf158]
call fcn.00409ca0
lea ecx, [esp + 0xf154]
call fcn.004073b0
test al, al
jne 0x4046c7
push esi
mov ecx, 0x47f1a0
call fcn.0041d4f0
lea ecx, [esp + 0xf154]
call fcn.00409010
push 0
lea ecx, [esp + 0xf158]
call fcn.00407210
test al, al
je 0x4046f1
push 4
mov ecx, 0x47f1a0
call fcn.0041d030
lea ecx, [esp + 0xf154]
call fcn.004072d0
test al, al
je 0x40470d
push 3
mov ecx, 0x47f1a0
call fcn.0041d030
mov al, byte [esp + 0x1a058]
mov byte [esp + 0xe108], al
test al, al
je 0x40483b
push 0xd2e
call fcn.00440940
jmp 0x404840
cmp dword [esp + 0x10174], edi
jne 0x404820
push edi
push esi
lea ecx, [esp + 0x320c]
mov byte [esp + 0xe154], 1
call fcn.00422170
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x1010], 0
je 0x4047c5
lea ecx, [esp + 0x1194]
call fcn.00421a00
mov ecx, dword [ebx + 0x38]
add ecx, 0x1010
push ecx
lea ecx, [esp + 0x1198]
mov byte [esp + 0x2e864], 4
call fcn.00422130
push 0x7fffffff
push 0x7fffffff
lea edx, [esp + 0x320c]
push edx
lea ecx, [esp + 0x11a0]
call fcn.00422630
lea ecx, [esp + 0x1194]
mov dword [esp + 0xe114], eax
mov byte [esp + 0x2e860], 3
call fcn.00422100
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6148], 0
je 0x4047f5
cmp dword [eax + 0x6134], 0
je 0x4047f5
push 0xd2e
mov byte [esp + 0xe10c], 1
call fcn.00440940
push esi
push eax
push 0xd2a
jmp 0x404847
cmp byte [esp + 0xe108], 0
je 0x404812
push 0xd2e
call fcn.00440940
push esi
push eax
push 0xd2a
jmp 0x404847
push esi
mov eax, 0x464474
push eax
push 0xd2a
jmp 0x404847
push esi
push 0
mov ecx, 0x47f1a0
call fcn.0041d3b0
push 9
mov ecx, 0x47f1a0
call fcn.0041d030
jmp 0x404855
mov eax, 0x464474
push esi
push eax
push 0xd2c
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 0xc
cmp dword [esp + 0xf158], 0xffffffff
mov eax, dword [esp + 0x130]
setne byte [esp + 0x17]
xor esi, esi
xor edi, edi
mov byte [esp + 0x14], 0
mov dword [esp + 0x3c], esi
cmp eax, esi
jbe 0x40493c
mov edi, edi
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
cmp dword [eax + 0x2c], 2
je 0x4048aa
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
cmp dword [eax + 0x2c], 3
jne 0x40492c
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
mov ecx, dword [eax + 0xc]
cmp ecx, edi
jb 0x4048e0
ja 0x4048c9
mov edx, dword [eax + 8]
cmp edx, dword [esp + 0x3c]
jbe 0x4048e0
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
mov ecx, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov dword [esp + 0x3c], ecx
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
mov edx, dword [eax + 8]
add dword [esp + 0xe13c], edx
mov eax, dword [eax + 0xc]
push esi
adc dword [esp + 0xe144], eax
lea ecx, [esp + 0xc8]
call fcn.00406b00
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x3208]
call fcn.004071f0
add dword [esp + 0xe144], eax
adc dword [esp + 0xe148], 0
mov eax, dword [esp + 0x130]
inc esi
cmp esi, eax
jb 0x404880
cmp byte [esp + 0x17], 0
je 0x404a59
mov edx, dword [esp + 0x1a054]
mov dword [esp + 0xe104], edx
test eax, eax
jne 0x404969
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x62b2], 0
je 0x404aad
lea ecx, [esp + 0x3204]
call fcn.00407310
push 0
push 1
lea ecx, [esp + 0xf15c]
push ecx
lea ecx, [esp + 0x3210]
call fcn.0040bb60
lea edx, [esp + 0xe11a]
push edx
lea eax, [esp + 0x19]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0xd0]
push edx
lea eax, [esp + 0xf164]
push eax
mov ecx, ebx
call fcn.00402350
cmp byte [esp + 0x15], 0
je 0x404aad
xor esi, esi
cmp dword [esp + 0x130], esi
jbe 0x4049f1
lea esp, [esp]
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
cmp dword [eax + 0x2c], 4
jne 0x404aad
inc esi
cmp esi, dword [esp + 0x130]
jb 0x4049d0
mov ecx, dword [ebx + 0x38]
cmp dword [ecx + 0x6180], 0
jne 0x404aad
push 0xa
mov ecx, 0x47f1a0
call fcn.0041cd40
lea ecx, [esp + 0x3204]
call fcn.00421d60
push 0xd4c
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 4
lea ecx, [esp + 0x3204]
mov byte [esp + 0x2e860], 2
call fcn.004079a0
lea ecx, [esp + 0xf154]
mov byte [esp + 0x2e860], 1
call fcn.004079a0
jmp 0x406565
mov edx, dword [ebx + 0x38]
xor eax, eax
cmp byte [edx + 0x6197], al
push 0
setne al
push 0
lea ecx, [esp + 0xf15c]
push ecx
lea ecx, [esp + 0x3210]
add eax, 2
mov dword [esp + 0xe110], eax
call fcn.0040bb60
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x6160]
mov eax, dword [eax + 0x6164]
mov edx, ecx
or edx, eax
je 0x404aad
push eax
push ecx
lea eax, [esp + 0x320c]
push eax
call fcn.00452f10
mov ecx, dword [esp + 0xe104]
push ecx
mov ecx, dword [ebx + 0x38]
call fcn.00414530
xor esi, esi
cmp dword [esp + 0x130], esi
jbe 0x404b20
jmp 0x404ad0
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6153], 0
je 0x404aef
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
cmp dword [eax + 0x2c], 2
je 0x404b02
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
cmp dword [eax + 0x2c], 1
jne 0x404b16
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
mov dword [eax + 0x2c], 0
inc esi
cmp esi, dword [esp + 0x130]
jb 0x404ad0
mov esi, dword [ebx + 0x38]
cmp word [esi + 0x73b0], 0
jne 0x404bc1
cmp byte [esp + 0x17], 0
je 0x404b42
cmp byte [esp + 0x1a058], 0
jne 0x404bc1
cmp byte [esp + 0x16], 0
jne 0x404bc1
mov eax, dword [esi + 0x6148]
test eax, eax
je 0x404b63
mov ecx, dword [esp + 0xe13c]
mov edx, dword [esp + 0xe140]
jmp 0x404b69
mov ecx, dword [esp + 0x3c]
mov edx, edi
neg eax
sbb eax, eax
and eax, 0xe0000
add eax, 0x20000
cmp dword [esi + 0xc], eax
jbe 0x404bc1
push 0
push 2
push edx
push ecx
call fcn.00453b90
mov edi, eax
lea esp, [esp]
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0xc]
xor esi, esi
cmp esi, edx
jb 0x404bc1
ja 0x404ba2
cmp eax, edi
jbe 0x404bc1
shr dword [ecx + 0xc], 1
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0x6148]
neg eax
sbb eax, eax
and eax, 0xe0000
add eax, 0x20000
cmp dword [ecx + 0xc], eax
ja 0x404b90
mov esi, 3
mov ecx, 0x400000
cmp dword [esp + 0xe104], esi
jne 0x404be7
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x619c], 0
je 0x404bfc
mov byte [eax + 0x619c], 0
cmp dword [esp + 0xe104], 2
jne 0x404bfc
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xc], ecx
jbe 0x404bfc
mov dword [eax + 0xc], ecx
mov eax, dword [ebx + 0x38]
xor edi, edi
cmp dword [eax + 0x6134], edi
jne 0x404c16
mov ecx, 0x20000
cmp dword [eax + 0xc], ecx
jbe 0x404c16
mov dword [eax + 0xc], ecx
cmp byte [esp + 0xe108], 0
je 0x404c30
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x617d], 0
jne 0x404c30
mov al, 1
jmp 0x404c32
xor al, al
push edi
push eax
lea ecx, [esp + 0xcc]
call fcn.004071b0
mov edx, dword [ebx + 0x38]
cmp dword [edx + 0x61a0], edi
je 0x404c83
cmp dword [esp + 0xe104], esi
jne 0x404c83
push 0xeac
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 4
lea eax, [esp + 0xc4]
push eax
mov ecx, ebx
call fcn.004028b0
push 0x464470
call fcn.00417aa0
add esp, 4
mov ecx, dword [ebx + 0x3c]
cmp ecx, edi
je 0x404c92
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp byte [esp + 0x17], 0
je 0x404ccc
cmp dword [esp + 0x1a054], esi
je 0x404cd8
push 0x1b498
call fcn.004547b0
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x2e860], 6
cmp eax, edi
je 0x404d02
lea ecx, [ebx + 0x58]
push ecx
mov ecx, eax
call fcn.004300f0
jmp 0x404d04
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x6197], 0
je 0x404ca2
push 0x6228
call fcn.004547b0
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x2e860], 5
cmp eax, edi
je 0x404d02
lea edx, [ebx + 0x58]
push edx
mov ecx, eax
call fcn.00429690
jmp 0x404d04
xor eax, eax
mov dword [ebx + 0x3c], eax
lea eax, [ebx + 0x58]
push eax
lea ecx, [esp + 0x1f0d0]
mov byte [esp + 0x2e864], 3
call fcn.00450f80
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax + 0x83b0]
mov edx, dword [edx + 0x20]
push eax
mov byte [esp + 0x2e864], 7
call edx
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x83b0]
mov dword [esp + 0x1f0e8], ecx
cmp ecx, 8
jb 0x404d5b
mov dword [esp + 0x1f0e8], 8
mov eax, dword [eax + 0xc]
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov esi, eax
push eax
mov eax, dword [edx + 4]
call eax
test al, al
jne 0x404d9a
mov edi, 0x100000
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xc], edi
jbe 0x404e36
shr dword [eax + 0xc], 1
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
test al, al
je 0x404d74
xor edi, edi
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0xc]
cmp esi, eax
je 0x404dbf
shr eax, 0x14
push eax
shr esi, 0x14
push esi
push 0xebe
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 0xc
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
lea esi, [ebx + 8]
push esi
call eax
cmp byte [esp + 0x1a058], 0
lea eax, [ebx + 0x58]
mov dword [esi + 0x24], ebx
mov ecx, dword [ebx + 0x38]
mov dword [esi + 0x2c], eax
lea edx, [esp + 0xf154]
lea eax, [esp + 0x3204]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x20], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
je 0x404e7d
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x5124], 0
jne 0x404e20
cmp byte [esp + 0x14], 0
je 0x404e5d
mov edx, dword [ebx + 0x48]
add dword [esp + 0xe13c], edx
mov eax, dword [ebx + 0x4c]
adc dword [esp + 0xe140], eax
jmp 0x404e62
push 1
push section..data
lea ecx, [esp + 0x44]
call fcn.0045396e
push 0x467918
lea eax, [esp + 0x40]
push eax
mov dword [esp + 0x44], vtable.std::bad_alloc.0
call fcn.00454713
mov byte [esp + 0x15], 1
push edi
lea ecx, [esp + 0xf158]
call fcn.0040c110
push edx
push eax
lea ecx, [esp + 0xf160]
call fcn.00407530
xor esi, esi
mov dword [esp + 0x13c], esi
mov dword [esp + 0x140], edi
mov dword [esp + 0x144], edi
mov dword [esp + 0x148], edi
mov byte [esp + 0x2e860], 8
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x18], edi
cmp dword [esp + 0x130], edi
jbe 0x405d71
lea esp, [esp]
mov ecx, dword [esp + 0x18]
push ecx
lea ecx, [esp + 0xc8]
call fcn.00406b00
mov ecx, 0x14
mov esi, eax
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x80], 0
je 0x405d54
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x90]
jmp 0x404f00
mov eax, dword [esp + 0x80]
cmp eax, 6
je 0x40580e
cmp eax, 5
je 0x405910
cmp eax, 4
je 0x4059b8
push 0
lea ecx, [esp + 0x96a0]
call fcn.00425810
lea ecx, [esp + 0x115c]
call fcn.00447310
lea ecx, [esp + 0x1164]
call fcn.00447310
lea ecx, [esp + 0x116c]
call fcn.00447310
lea ecx, [esp + 0x1194]
call fcn.00421a00
cmp byte [esp + 0xa1], 0
mov byte [esp + 0x2e860], 0xa
je 0x404fa9
cmp dword [esp + 0xe104], 3
jne 0x404fa9
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6189], 0
mov byte [esp + 0x13], 1
je 0x404fae
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x969c]
push eax
push ecx
call fcn.0041f170
cmp dword [esp + 0xa78c], 0
jne 0x404fae
mov byte [esp + 0x13], 0
mov al, byte [esp + 0xa0]
test al, al
jne 0x404fd1
cmp byte [esp + 0x13], al
je 0x404fca
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6189], al
jne 0x404fd1
mov byte [esp + 0x2a], 0
jmp 0x404fea
mov byte [esp + 0x2a], 1
test al, al
je 0x404fea
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6158], 1
je 0x405d40
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], 0
jne 0x405037
movzx ecx, byte [eax + 0x6189]
mov eax, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x150]
push edx
push eax
call fcn.00424a90
cmp byte [esp + 0xa0], 0
mov byte [esp + 0x13], al
je 0x405047
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x1174]
call fcn.00447250
jmp 0x405047
mov byte [esp + 0x13], 0
mov dword [esp + 0x11a0], 1
mov cl, byte [esp + 0x2a]
test cl, cl
jne 0x4051ce
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], 0
jne 0x4051ce
cmp byte [esp + 0x13], cl
je 0x40508a
movzx eax, byte [eax + 0x6195]
mov ecx, dword [esp + 0x54]
neg eax
sbb eax, eax
and eax, 4
push eax
push ecx
lea ecx, [esp + 0x119c]
call fcn.00421a40
cmp dword [esp + 0x1198], 0xffffffff
jne 0x40512b
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x30]
push edx
push eax
mov ecx, 0x47f1a0
call fcn.0041d380
mov ecx, dword [esp + 0x5c]
sub dword [esp + 0xe13c], ecx
mov edx, dword [esp + 0x60]
push edi
sbb dword [esp + 0xe144], edx
lea ecx, [esp + 0xc8]
call fcn.00406b00
inc dword [esp + 0x38]
mov dword [eax + 0x2c], 0
test esi, esi
jl 0x405d40
jg 0x4050f2
cmp dword [esp + 0x8c], 0
jbe 0x405d40
cmp dword [esp + 0x98], 0
jne 0x405d40
lea ecx, [esp + 0x1194]
mov dword [esp + 0x80], 4
mov dword [ebx + 0x40], 0
mov byte [esp + 0x2e860], 8
call fcn.00422100
jmp 0x404f00
cmp byte [esp + 0x13], 0
je 0x405146
lea ecx, [esp + 0x115c]
call fcn.00447240
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
cmp byte [esp + 0xa1], 0
jne 0x4051ec
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x618a], 0
je 0x4051ec
cmp dword [esp + 0xe104], 3
jne 0x4051ec
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x119c]
push eax
mov ecx, ebx
mov dword [esp + 0xb0], edi
call fcn.00402680
test al, al
je 0x4051ec
mov edx, dword [esp + 0xa4]
push 0x800
lea ecx, [esp + 0xa794]
push ecx
push edx
lea ecx, [esp + 0xd0]
mov dword [esp + 0xa798], 4
call fcn.00406b00
push eax
mov eax, dword [ebx + 0x38]
push eax
jmp 0x405257
cmp byte [esp + 0xa1], 0
jne 0x4051e8
xor eax, eax
mov dword [esp + 0x114c], eax
mov dword [esp + 0x1150], eax
test cl, cl
jne 0x405261
cmp dword [esp + 0x9c], 0xffffffff
je 0x405261
cmp dword [esp + 0x1198], 0xffffffff
je 0x40520c
lea ecx, [esp + 0x1194]
call fcn.00421d00
mov esi, dword [esp + 0x9c]
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b00
mov eax, dword [eax + 0x2c]
cmp eax, 2
je 0x40522d
cmp eax, 3
jne 0x405261
push 0x800
lea ecx, [esp + 0xa794]
push ecx
push esi
lea ecx, [esp + 0xd0]
mov dword [esp + 0xa798], 5
call fcn.00406b00
mov edx, dword [ebx + 0x38]
push eax
push edx
call fcn.00401560
mov byte [esp + 0x2a], 1
mov eax, dword [esp + 0x54]
push eax
push 1
mov ecx, 0x47f1b0
call fcn.00414800
mov eax, dword [ebx + 0x38]
push 0x800
lea ecx, [esp + 0x96c0]
push ecx
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.00401560
cmp byte [esp + 0x16], 0
je 0x4052fc
lea ecx, [esp + 0xf154]
call fcn.00407570
push 0
lea ecx, [esp + 0xf158]
mov esi, eax
mov edi, edx
call fcn.0040c110
push edx
push eax
lea ecx, [esp + 0xf160]
call fcn.00407530
push 0
lea ecx, [esp + 0x1f0d0]
push ecx
push edi
push esi
lea edx, [esp + 0xf164]
push edx
mov ecx, ebx
call fcn.004020b0
mov edx, dword [ebx + 0x38]
mov edx, dword [edx + 0x6134]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
dec edx
push edx
lea edx, [esp + 0x1f0d0]
push edx
call eax
mov byte [ebx + 0x54], 1
xor edi, edi
cmp byte [esp + 0xe108], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x15], 0
je 0x40542b
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x6148]
mov byte [esp + 0x14], 0
test cl, 2
je 0x405349
mov esi, dword [eax + 0x614c]
cmp esi, edi
jle 0x405349
cmp dword [esp + 0x1c], edi
jle 0x405349
mov eax, dword [esp + 0x1c]
cdq
idiv esi
test edx, edx
jne 0x405349
mov byte [esp + 0x14], 1
test cl, 4
je 0x405394
lea ecx, [esp + 0x96bc]
push ecx
call fcn.004318f0
mov esi, eax
cmp esi, edi
je 0x40538a
lea edx, [esp + 0x2d7cc]
push edx
push esi
call fcn.00445fc0
test eax, eax
je 0x405378
mov byte [esp + 0x14], 1
push 0x40
push esi
lea eax, [esp + 0x2d7d4]
push eax
call fcn.00446010
jmp 0x405394
xor ecx, ecx
mov word [esp + 0x2d7cc], cx
mov edx, dword [ebx + 0x38]
mov edx, dword [edx + 0x6148]
test dl, 8
jne 0x4053f6
lea ecx, [esp + 0x3222]
lea eax, [esp + 0x2d84c]
mov si, word [eax]
cmp si, word [ecx]
jne 0x4053d6
cmp si, di
je 0x4053d2
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x4053d6
add eax, 4
add ecx, 4
cmp si, di
jne 0x4053b0
xor eax, eax
jmp 0x4053db
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4053f6
test dl, 0x10
jne 0x4053fd
cmp dword [esp + 0x50], edi
jg 0x4053fd
jl 0x4053f6
cmp dword [esp + 0x4c], 0x400000
ja 0x4053fd
cmp byte [esp + 0x14], 0
je 0x40541b
cmp dword [esp + 0x1c], edi
jle 0x40541b
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov byte [ebx + 0x54], 0
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
jmp 0x40542b
mov eax, dword [esp + 0x5c]
add dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x60]
adc dword [esp + 0x50], ecx
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [esp + eax + 0x3222]
mov word [esp + eax + 0x2d84c], cx
add eax, 2
cmp cx, di
jne 0x405430
mov eax, dword [esp + 0x80]
cmp eax, 2
jne 0x405460
mov edx, dword [esp + 0x54]
push edx
push 0xd30
jmp 0x40546f
cmp eax, 3
jne 0x40547d
mov eax, dword [esp + 0x54]
push eax
push 0xd32
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 8
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], di
jne 0x405499
mov ecx, dword [esp + 0x115c]
or ecx, dword [esp + 0x1160]
jne 0x4054ab
mov dword [esp + 0x114c], edi
mov dword [esp + 0x1150], 0x100
cmp dword [esp + 0xe104], 3
mov edx, dword [esp + 0x114c]
mov ecx, dword [esp + 0x1150]
mov dword [esp + 0x96a0], 2
mov dword [esp + 0xa6ec], edx
mov dword [esp + 0xa6f0], ecx
mov dword [esp + 0xa6e4], edi
mov dword [esp + 0xa6e8], edi
jne 0x4054f2
mov edi, dword [eax + 0x6138]
jmp 0x4054f7
mov edi, 2
push edi
lea ecx, [esp + 0xa700]
call fcn.00425360
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x5124], 0
je 0x4055b3
cmp byte [esp + 0xa0], 0
jne 0x4055b3
mov esi, dword [esp + 0xe104]
cmp esi, 3
jne 0x405569
push 0x10
lea eax, [esp + 0xa741]
push eax
call fcn.0041a470
cmp byte [esp + 0xe110], 0
mov esi, dword [esp + 0xe104]
sete cl
mov dword [esp + 0xa778], 0xf
mov byte [esp + 0xa74d], 1
mov byte [esp + 0xa756], cl
mov edx, dword [esp + 0xe11a]
mov eax, dword [esp + 0xe11e]
mov ecx, dword [esp + 0xe122]
mov dword [esp + 0xa72d], edx
mov edx, dword [esp + 0xe126]
mov byte [esp + 0xa727], 1
mov byte [esp + 0xa72c], 1
mov dword [esp + 0xa731], eax
mov dword [esp + 0xa735], ecx
mov dword [esp + 0xa739], edx
jmp 0x4055ba
mov esi, dword [esp + 0xe104]
cmp esi, 3
sete al
dec al
and al, 0x1d
cmp byte [ebx + 0x54], 0
mov byte [esp + 0x96b5], al
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0xa780], ecx
je 0x4055e6
mov byte [esp + 0xa77c], 1
cmp byte [esp + 0x13], 0
je 0x405645
mov edx, dword [esp + 0x115c]
mov ecx, dword [esp + 0x1160]
mov dword [esp + 0xa6cc], edx
mov edx, dword [esp + 0x116c]
mov dword [esp + 0xa6d0], ecx
mov ecx, dword [esp + 0x1170]
mov dword [esp + 0xa6dc], edx
mov edx, dword [esp + 0x1164]
mov dword [esp + 0xa6e0], ecx
mov ecx, dword [esp + 0x1168]
mov dword [esp + 0xa6d4], edx
mov dword [esp + 0xa6d8], ecx
xor edx, edx
jmp 0x405671
xor edx, edx
mov dword [esp + 0xa6cc], edx
mov dword [esp + 0xa6d0], edx
mov dword [esp + 0xa6dc], edx
mov dword [esp + 0xa6e0], edx
mov dword [esp + 0xa6d4], edx
mov dword [esp + 0xa6d8], edx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x96b8], ecx
cmp esi, 2
je 0x40568a
cmp dword [esp + 0xa78c], edx
jne 0x405697
and ecx, 0xfffffbff
mov dword [esp + 0x96b8], ecx
cmp dword [esp + 0xa6f0], edx
movzx ecx, byte [esp + 0xa0]
mov byte [esp + 0xa77d], cl
movzx ecx, byte [eax + 0x6134]
mov byte [esp + 0x96b6], cl
jg 0x4056da
jl 0x4056cc
cmp dword [esp + 0xa6ec], 0x80000000
ja 0x4056da
cmp word [eax + 0x73b0], dx
jne 0x4056da
cmp esi, 3
jne 0x4056e2
mov byte [esp + 0xa785], 1
mov edx, dword [eax + 0x83b0]
push edx
push edi
lea ecx, [ebx + 0x249c]
call fcn.00425490
lea eax, [esp + 0x3204]
push eax
lea ecx, [esp + 0x1198]
push ecx
lea esi, [ebx + 0x58]
mov ecx, esi
mov dword [esp + 0xa790], 0
call fcn.00437540
mov edx, dword [esp + 0x1150]
xor eax, eax
mov dword [ebx + 0x18f8], eax
mov dword [ebx + 0x18fc], eax
mov eax, dword [esp + 0x114c]
xor edi, edi
cmp byte [esp + 0x2a], 0
mov byte [ebx + 0xa8], 1
mov dword [esp + 0xa6f4], eax
mov dword [esp + 0xa6f8], edx
jne 0x405bd4
mov ecx, dword [ebx + 0x38]
cmp word [ecx + 0x73b0], di
jne 0x405bd4
lea edx, [esp + 0x2f]
push edx
lea eax, [esp + 0x32]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00437460
cmp byte [esp + 0x2e], 0
je 0x405ae8
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x30]
push edx
push eax
mov ecx, 0x47f1a0
call fcn.0041d380
mov ecx, dword [esp + 0x5c]
sub dword [esp + 0xe13c], ecx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x60]
sbb dword [esp + 0xe140], edx
push eax
lea ecx, [esp + 0xc8]
call fcn.00406b00
inc dword [esp + 0x38]
cmp dword [esp + 0x90], edi
mov dword [eax + 0x2c], edi
jl 0x405d40
jg 0x4057e7
cmp dword [esp + 0x8c], edi
jbe 0x405d40
lea ecx, [esp + 0x1194]
mov dword [esp + 0x80], 4
mov dword [ebx + 0x40], edi
mov byte [esp + 0x2e860], 8
call fcn.00422100
jmp 0x404eec
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x8c]
push 0
push esi
push ecx
lea ecx, [esp + 0xf160]
call fcn.00407530
lea ecx, [esp + 0xf154]
call fcn.0040ea40
mov eax, dword [esp + 0x148b8]
cmp eax, 2
je 0x4058b5
cmp eax, 3
je 0x4058be
mov dl, byte [esp + 0x1a060]
cmp dl, byte [esp + 0xe110]
jne 0x405d54
mov eax, dword [esp + 0x1a048]
mov ecx, dword [esp + 0x1a044]
push 0
push eax
push ecx
lea ecx, [esp + 0xf160]
call fcn.00407530
mov edx, dword [esp + 0x1a04c]
sub edx, dword [esp + 0x1a044]
mov eax, dword [esp + 0x1a050]
sbb eax, dword [esp + 0x1a048]
lea ecx, [esp + 0x3204]
push eax
push edx
push ecx
lea ecx, [esp + 0xf160]
call fcn.00422630
jmp 0x405d54
lea ecx, [esp + 0x155ec]
jmp 0x4058c5
lea ecx, [esp + 0x1792c]
push 0
push 0
push ecx
push eax
lea ecx, [esp + 0x3214]
call fcn.00409da0
lea ecx, [esp + 0xf154]
call fcn.00407570
mov ecx, dword [esp + 0x1a04c]
sub ecx, eax
mov eax, dword [esp + 0x1a050]
sbb eax, edx
push eax
push ecx
lea ecx, [esp + 0x320c]
push ecx
lea ecx, [esp + 0xf160]
call fcn.00422630
jmp 0x405d54
mov eax, dword [esp + 0xf154]
lea edx, [esp + 0xf154]
mov dword [esp + 0xac], edx
mov ecx, edx
mov edx, dword [eax + 0xc]
call edx
mov esi, eax
mov edi, edx
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], edi
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x8c]
push 0
push eax
push ecx
lea ecx, [esp + 0xf160]
mov byte [esp + 0x2e86c], 9
call fcn.00407530
lea ecx, [esp + 0xf154]
call fcn.0040ea40
lea edx, [esp + 0x1560c]
push edx
push 0xd9a
call fcn.00440940
push eax
call fcn.00417aa0
inc dword [esp + 0x28]
add esp, 8
call fcn.00446620
mov eax, dword [esp + 0xf154]
mov edx, dword [eax + 8]
push 0
push edi
push esi
lea ecx, [esp + 0xf160]
mov byte [esp + 0x2e86c], 8
call edx
jmp 0x405d54
cmp byte [esp + 0x1a058], 0
je 0x405a22
cmp byte [esp + 0x15], 0
jne 0x405a22
mov ecx, dword [esp + 0x8c]
push 0
lea eax, [esp + 0x1f0d0]
push eax
push esi
push ecx
lea edx, [esp + 0xf164]
push edx
mov ecx, ebx
call fcn.004020b0
mov eax, dword [esp + 0x98]
mov edx, dword [ebx + 0x3c]
push eax
push 0
lea ecx, [esp + 0x1f0d4]
push ecx
push edx
lea eax, [esp + 0x3214]
push eax
lea ecx, [esp + 0xf168]
push ecx
mov ecx, ebx
call fcn.004036f0
call fcn.00446620
jmp 0x405d54
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x8c]
push 0
push esi
push ecx
lea ecx, [esp + 0xf160]
call fcn.00407530
lea ecx, [esp + 0xf154]
call fcn.0040ea40
lea edx, [esp + 0x155ec]
push edx
lea ecx, [esp + 0x96a0]
call fcn.004258f0
mov eax, dword [esp + 0x98]
test eax, eax
je 0x405a7e
push eax
lea eax, [esp + 0x96a0]
push eax
mov ecx, ebx
call fcn.00401670
lea ecx, [esp + 0xf154]
call fcn.0040c030
test al, al
jne 0x405a99
mov cl, byte [esp + 0x1a058]
mov byte [esp + 0x16], cl
cmp byte [esp + 0x16], 0
je 0x405ab6
mov edx, dword [ebx + 0x38]
mov eax, dword [edx + 0xc]
cmp eax, dword [esp + 0xa780]
jbe 0x405ab6
mov dword [esp + 0xa780], eax
push 0
push 0
push 0
push 2
lea ecx, [esp + 0x3214]
call fcn.00409da0
lea eax, [esp + 0xf154]
push eax
lea ecx, [esp + 0x3208]
call fcn.00407360
call fcn.00446620
jmp 0x405d54
cmp byte [esp + 0x2f], 0
je 0x405b3d
mov ecx, dword [esp + 0x1150]
mov edx, dword [esp + 0x24]
xor eax, eax
cmp ecx, eax
mov eax, dword [esp + 0x114c]
ja 0x405b25
jb 0x405b0d
cmp eax, edx
jae 0x405b25
mov byte [esp + 0x34], 1
mov edx, dword [esp + 0x34]
push edx
push 1
push ecx
push eax
call fcn.00401710
jmp 0x405bc6
mov byte [esp + 0x34], 0
mov edx, dword [esp + 0x34]
push edx
push 1
push ecx
push eax
call fcn.00401710
jmp 0x405bc6
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov esi, ecx
push esi
mov dword [esp + 0x1150], eax
mov edi, eax
add eax, 0x200
mov dword [esp + 0x1154], ecx
push 2
adc ecx, ecx
push ecx
push eax
call fcn.00453b90
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
cmp edx, esi
ja 0x405b84
jb 0x405b78
cmp eax, edi
jae 0x405b84
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], 0x40000000
mov edi, dword [esp + 0x3c]
mov esi, 1
xor eax, eax
mov edx, esi
add edx, 0xffffffff
mov ecx, eax
adc ecx, 0xffffffff
cmp dword [esp + 0x40], ecx
jb 0x405bb8
ja 0x405ba5
cmp edi, edx
jb 0x405bb8
shld eax, esi, 7
shl esi, 7
mov edx, esi
or edx, eax
jne 0x405b8f
mov edx, dword [esp + 0x40]
jmp 0x405bc2
add esi, 0xffffffff
adc eax, 0xffffffff
mov edi, esi
mov edx, eax
mov eax, edi
xor edi, edi
mov dword [esp + 0xa6f8], edx
mov dword [esp + 0xa6f4], eax
mov ecx, dword [esp + 0xe104]
inc dword [esp + 0x1c]
cmp ecx, 3
jne 0x405bf0
mov dword [ebx + 0x1920], eax
mov dword [ebx + 0x1924], edx
test byte [esp + 0x94], 1
jne 0x405c09
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6134], edi
je 0x405c09
xor al, al
jmp 0x405c0b
mov al, 1
cmp byte [esp + 0x2a], 0
mov byte [esp + 0x14], al
jne 0x405c1a
test al, al
je 0x405c3f
mov edx, dword [ebx + 0x38]
mov byte [esp + 0x96b6], 0
cmp byte [edx + 0x5124], 0
jne 0x405c3b
cmp ecx, 3
je 0x405c3b
mov byte [esp + 0x96b5], 0x14
test al, al
jne 0x405c6b
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
xor ecx, ecx
add eax, dword [esp + 0xa6ec]
adc ecx, dword [esp + 0xa6f0]
mov dword [esp + 0xa8], ecx
js 0x405c75
jg 0x405c6b
cmp eax, 0x8000
jbe 0x405c75
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x2a]
mov edx, dword [esp + 0x54]
mov eax, dword [ebx + 0x3c]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x11a4]
push ecx
lea esi, [ebx + 8]
mov ecx, esi
call fcn.004034d0
cmp byte [esp + 0x2a], 0
jne 0x405cf5
cmp byte [esp + 0x14], 0
je 0x405cc6
push edi
mov ecx, esi
call fcn.00403590
lea eax, [ebx + 0x58]
push eax
call fcn.004025d0
push edi
mov ecx, esi
call fcn.00402fc0
mov dword [esi + 8], edi
mov dword [esi + 4], edi
jmp 0x405cf5
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea esi, [eax + 0x62dc]
mov eax, dword [eax + 0x6134]
push esi
dec eax
push eax
movzx eax, byte [ebx + 0x54]
push eax
call edx
cmp byte [esp + 0xe108], 0
je 0x405cff
mov byte [ebx + 0x54], 1
cmp byte [esp + 0xe108], 0
jne 0x405d09
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
call fcn.00446620
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x6144], 0
mov esi, 0x464474
jne 0x405d24
mov esi, 0x464460
push 0xd1c
call fcn.00440940
push eax
push esi
push 0x464454
call fcn.00417aa0
add esp, 0xc
mov dword [ebx + 0x28], edi
lea ecx, [esp + 0x1194]
mov byte [esp + 0x2e860], 8
call fcn.00422100
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x130]
jb 0x404ec0
mov esi, dword [esp + 0x13c]
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov edi, dword [esp + 0x38]
test edi, edi
jle 0x405dba
push 6
mov ecx, 0x47f1a0
call fcn.0041cd40
cmp edi, 1
jle 0x405d9b
push 0xd48
jmp 0x405da0
push 0xd4a
call fcn.00440940
push eax
push edi
push 0xd46
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 0xc
cmp dword [esp + 0x1c], 0
jne 0x405e19
cmp dword [esp + 0x20], 0
jne 0x405e19
push 0xd4c
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 4
push 0xa
mov ecx, 0x47f1a0
call fcn.0041cd40
lea ecx, [esp + 0x3204]
call fcn.00421d60
test esi, esi
je 0x405e00
push esi
call fcn.00453bc4
add esp, 4
lea ecx, [esp + 0x1f0cc]
mov byte [esp + 0x2e860], 3
call fcn.0044e2f0
jmp 0x404a2c
cmp byte [esp + 0x17], 0
je 0x405e36
lea ecx, [esp + 0xf154]
push ecx
lea ecx, [esp + 0x3208]
call fcn.0040a970
jmp 0x405e46
push 0
push 0
lea ecx, [esp + 0x320c]
call fcn.0040afc0
test esi, esi
je 0x405e53
push esi
call fcn.00453bc4
add esp, 4
lea ecx, [esp + 0x1f0cc]
mov byte [esp + 0x2e860], 3
call fcn.0044e2f0
lea edx, [esp + 0x3222]
push edx
push 0
mov ecx, 0x47f1b0
call fcn.00414800
mov eax, dword [ebx + 0x38]
movzx esi, word [eax + 0x639c]
add eax, 0x639c
test si, si
je 0x405eb9
xor ecx, ecx
cmp si, 0x40
sete cl
lea edx, [esp + 0x3222]
dec ecx
and eax, ecx
push eax
push edx
call fcn.004467f0
test al, al
jne 0x405eb9
push 2
mov ecx, 0x47f1a0
call fcn.0041d030
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x6150], 0
je 0x405fde
push 0xd42
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 4
cmp dword [esp + 0x130], 0
mov dword [esp + 0x20], 0
jbe 0x405fde
mov ecx, dword [esp + 0x20]
push ecx
lea ecx, [esp + 0xc8]
call fcn.00406b00
mov esi, eax
mov ecx, 0x14
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x80]
cmp eax, 2
je 0x405f25
cmp eax, 3
jne 0x405fc8
lea ecx, [esp + 0x115c]
call fcn.00447310
lea ecx, [esp + 0x1164]
call fcn.00447310
lea ecx, [esp + 0x116c]
call fcn.00447310
mov esi, dword [esp + 0x54]
push 0
lea edx, [esp + 0x150]
push edx
push esi
call fcn.00424a90
test al, al
je 0x405fc8
lea ecx, [esp + 0x115c]
call fcn.00447240
cmp eax, dword [esp + 0x6c]
jne 0x405fc8
cmp edx, dword [esp + 0x70]
jne 0x405fc8
mov eax, dword [esp + 0x114c]
cmp eax, dword [esp + 0x5c]
jne 0x405fc8
mov ecx, dword [esp + 0x1150]
cmp ecx, dword [esp + 0x60]
jne 0x405fc8
cmp byte [esp + 0xa0], 0
jne 0x405fc8
mov edx, dword [esp + 0x64]
and edx, 0xffffffdf
push edx
push esi
call fcn.00422ac0
test al, al
jne 0x405fc8
push esi
push 0xe76
call fcn.00440940
push eax
mov eax, dword [esp + 0x38]
push eax
call fcn.004183e0
add esp, 0xc
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x130]
jb 0x405ef2
cmp word [esp + 0xe14e], 0
lea eax, [esp + 0xe14e]
jne 0x405ff7
lea eax, [esp + 0x3222]
mov ecx, dword [ebx + 0x38]
push 0x800
push eax
add ecx, 0x93e2
push ecx
mov dword [esp + 0x28], eax
call fcn.00446010
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x62d9], 0
je 0x406264
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x40602f
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
push 0xa5b0
mov dword [ebx + 0x3c], 0
call fcn.004547b0
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x2e860], 0xb
test eax, eax
je 0x40605c
mov ecx, eax
call fcn.00415530
jmp 0x40605e
xor eax, eax
mov byte [eax + 0x62d9], 1
mov ecx, dword [ebx + 0x38]
mov edx, dword [ecx + 0x83b0]
mov dword [eax + 0x83b0], edx
mov dword [eax + 0x739c], 1
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6144]
mov byte [eax + 0x6144], dl
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6152]
mov byte [eax + 0x6152], dl
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6195]
mov byte [eax + 0x6195], dl
mov ecx, 0x464450
mov dword [esp + 0x18], eax
sub eax, ecx
mov byte [esp + 0x2e860], 3
lea edx, [eax + 0x83c2]
jmp 0x4060d0
movzx eax, word [ecx]
mov word [ecx + edx], ax
add ecx, 2
test ax, ax
jne 0x4060d0
mov esi, dword [ebx + 0x38]
mov edi, dword [esp + 0x18]
add esi, 0x5024
add edi, 0x5024
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x15], al
mov eax, dword [esp + 0x1c]
push eax
movsw word es:[edi], word [esi]
call fcn.00423160
mov esi, dword [esp + 0x1c]
test al, al
jne 0x406150
mov edi, 0x2e
jmp 0x406120
mov ecx, dword [ebx + 0x38]
cmp word [ecx + 0x639c], di
je 0x40614b
push esi
call fcn.00452840
test al, al
sete al
mov byte [esp + 0x15], al
cmp al, 1
je 0x406150
push esi
call fcn.00423160
test al, al
je 0x406120
jmp 0x406150
mov byte [esp + 0x15], 1
cmp byte [esp + 0x15], 0
mov byte [esp + 0x14], 0
jne 0x4061e6
push esi
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.004143c0
push 0x46444c
lea ecx, [esi + 0xa3e4]
call fcn.00446380
mov edx, dword [0x47f1a4]
push 0x5c38
mov dword [esp + 0x28], edx
call fcn.004547b0
add esp, 4
mov dword [esp + 0x34], eax
mov byte [esp + 0x2e860], 0xc
test eax, eax
je 0x4061af
push esi
mov ecx, eax
call fcn.0041f6d0
mov edi, eax
jmp 0x4061b1
xor edi, edi
push esi
mov ecx, edi
mov byte [esp + 0x2e864], 3
call fcn.00421170
test edi, edi
je 0x4061d5
mov ecx, edi
call fcn.0041f7b0
push edi
call fcn.00453a2c
add esp, 4
mov eax, dword [esp + 0x24]
cmp eax, dword [0x47f1a4]
setne byte [esp + 0x14]
jmp 0x4061ea
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 0xa554]
test eax, eax
je 0x4061fd
push eax
call fcn.00453bc4
add esp, 4
mov eax, dword [esi + 0xa4f8]
test eax, eax
je 0x406210
push eax
call fcn.00453bc4
add esp, 4
mov eax, dword [esi + 0xa49c]
test eax, eax
je 0x406223
push eax
call fcn.00453bc4
add esp, 4
mov eax, dword [esi + 0xa440]
test eax, eax
je 0x406236
push eax
call fcn.00453bc4
add esp, 4
mov eax, dword [esi + 0xa3e4]
test eax, eax
je 0x406249
push eax
call fcn.00453bc4
add esp, 4
mov ecx, esi
call fcn.004274c0
push esi
call fcn.00453a2c
add esp, 4
cmp byte [esp + 0x14], 0
jne 0x404a2c
mov ecx, dword [ebp + 0x10]
cmp word [ecx], 0x4d
je 0x40627d
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6196], 0
je 0x4064fb
push 1
push 0
lea ecx, [esp + 0xcc]
call fcn.004071b0
mov esi, dword [esp + 0x130]
or edi, 0xffffffff
lea ecx, [esp + 0xac]
dec esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], edi
call fcn.00423eb0
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x619a], 0
mov byte [esp + 0x2e860], 0xd
mov byte [esp + 0x15], 0
je 0x406304
call fcn.00414cb0
test al, al
jne 0x406304
cmp dword [esp + 0x38], 0
jne 0x406304
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x6153], 0
jne 0x406304
cmp byte [eax + 0x6154], 0
jne 0x406304
mov edi, dword [esp + 0x130]
mov byte [esp + 0x15], 1
xor esi, esi
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], esi
cmp esi, edi
je 0x4064e7
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0xc8]
call fcn.00406b00
mov esi, eax
mov ecx, 0x14
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x80]
cmp eax, 2
je 0x406343
cmp eax, 3
jne 0x4064d1
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x619a], 0
mov esi, dword [esp + 0x54]
jne 0x406367
mov edx, dword [esp + 0x64]
push edx
call fcn.00422a40
test al, al
jne 0x406367
push esi
call fcn.00423280
mov eax, dword [ebp + 0x10]
cmp word [eax + 2], 0x46
setne al
cmp byte [esp + 0xa0], 0
je 0x406412
test al, al
je 0x4064d1
mov eax, dword [ebx + 0x38]
mov cl, byte [eax + 0x619a]
test cl, cl
je 0x4063cd
cmp byte [esp + 0x15], 0
je 0x4063cd
push esi
call fcn.00423160
test al, al
je 0x4064d1
push esi
lea ecx, [esp + 0xb0]
call fcn.00423ef0
lea ecx, [esp + 0xac]
call fcn.004233d0
mov byte [esp + 0x13], 1
jmp 0x406459
cmp byte [eax + 0x6199], 0
je 0x4063fa
push esi
call fcn.00422dc0
test al, al
je 0x4063e8
push esi
call fcn.00423430
jmp 0x406455
push 0x91
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x406459
test cl, cl
je 0x40640a
lea ecx, [esp + 0xac]
call fcn.004233d0
push esi
call fcn.00422c60
jmp 0x406455
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x619a], 0
push esi
je 0x406440
call fcn.00423160
test al, al
je 0x4064d1
push esi
lea ecx, [esp + 0xb0]
call fcn.00423ef0
mov byte [esp + 0x13], 1
jmp 0x406459
cmp byte [eax + 0x6199], 0
je 0x406450
call fcn.00423fe0
jmp 0x406455
call fcn.00422be0
mov byte [esp + 0x13], al
xor ecx, ecx
cmp byte [esp + 0xa0], cl
push esi
setne cl
lea ecx, [ecx*8 + 0xd3c]
push ecx
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 8
cmp byte [esp + 0x13], 0
je 0x406498
push 0xd3e
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 4
jmp 0x4064d1
push 0xd40
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 4
push esi
push 0xe8e
call fcn.00440940
push eax
lea edx, [esp + 0x322a]
push edx
call fcn.004183e0
add esp, 0xc
mov ecx, 0x47f1a0
call fcn.0041d050
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x34]
jne 0x406310
lea ecx, [esp + 0xac]
mov byte [esp + 0x2e860], 3
call fcn.00423ed0
cmp byte [esp + 0xe109], 0
je 0x406524
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6140], 0
je 0x406524
lea ecx, [esp + 0xe14e]
push ecx
push eax
call fcn.0043b340
jmp 0x404a2c
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6146], 0
jne 0x404a2c
push 0xd1e
jmp 0x404a1e
cmp ecx, 3
jne 0x406556
push 0xeac
call fcn.00440940
push eax
call fcn.00417aa0
add esp, 4
lea eax, [esp + 0xc4]
push eax
mov ecx, ebx
call fcn.004028b0
mov eax, dword [esp + 0x120]
test eax, eax
je 0x406579
push eax
call fcn.00453bc4
add esp, 4
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x40658d
push eax
call fcn.00453bc4
add esp, 4
lea ecx, [esp + 0x1b0a4]
mov dword [esp + 0x2e860], 0xffffffff
call fcn.00442e90
mov ecx, dword [esp + 0x2e858]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2e840]
xor ecx, esp
call fcn.004538da
mov esp, ebp
pop ebp
ret 0xc