Function at 0x4094c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
cmp ecx, 0x13
jle 0x409270
mov eax, 4
xor edi, edi
nop
add eax, eax
add edi, 1
lea edx, [eax + 0xf]
cmp ecx, edx
jg 0x409220
mov dword [esp], edi
call fcn.0040ae90
lea edx, [esi + 1]
mov dword [eax], edi
movzx ecx, byte [esi]
lea edi, [eax + 4]
mov byte [eax + 4], cl
mov eax, edi
test cl, cl
je 0x40925f
lea esi, cs:[esi]
movzx ecx, byte [edx]
add eax, 1
add edx, 1
mov byte [eax], cl
test cl, cl
jne 0x409250
test ebx, ebx
je 0x409265
mov dword [ebx], eax
add esp, 0x10
mov eax, edi
pop ebx
pop esi
pop edi
ret
xor edi, edi
jmp 0x40922c
push ebp
push edi
push esi
push ebx
sub esp, 0xac
mov eax, dword [esp + 0xc4]
mov ecx, dword [esp + 0xd4]
mov esi, dword [esp + 0xd0]
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x38], ecx
mov edx, dword [esp + 0xd8]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0xdc]
mov ebp, dword [eax]
mov ecx, eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x3c], edi
mov eax, ebp
mov dword [esp + 0x24], edx
and eax, 0xffffffcf
mov dword [esp + 0x28], esi
mov dword [ecx], eax
mov eax, ebp
and eax, 7
cmp eax, 3
je 0x4097f8
mov esi, ebp
and esi, 4
mov dword [esp + 0x34], esi
jne 0x409570
test eax, eax
je 0x4097b8
sub eax, 1
mov dword [esp + 0x18], 0
cmp eax, 1
jbe 0x4095b8
mov eax, dword [esp + 0x18]
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 4
jne 0x409790
mov eax, dword [esp + 0x24]
mov dword [eax], 0xffff8000
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc8], 3
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc0], 0x410f79
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
jmp 0x409200
mov esi, dword [edi]
xor edx, edx
mov eax, 0x20
cmp esi, 0x20
jle 0x4095cf
add eax, eax
add edx, 1
cmp esi, eax
jg 0x4095c6
mov dword [esp], edx
lea ebx, [esi - 1]
sar ebx, 5
shl ebx, 2
call fcn.0040ae90
mov dword [esp + 0x18], ebx
mov edi, eax
mov eax, dword [esp + 0x2c]
lea edx, [edi + 0x14]
lea ecx, [eax + ebx]
mov ebx, dword [eax]
add eax, 4
add edx, 4
mov dword [edx - 4], ebx
cmp ecx, eax
jae 0x4095f0
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
add ecx, 1
add eax, 1
add ebx, 4
cmp ecx, eax
mov eax, 4
cmovb ebx, eax
sar ebx, 2
jmp 0x409628
test ebx, ebx
je 0x409838
mov eax, ebx
sub ebx, 1
mov edx, dword [edi + ebx*4 + 0x14]
test edx, edx
je 0x409620
bsr edx, dword [edi + ebx*4 + 0x14]
mov dword [edi + 0x10], eax
shl eax, 5
xor edx, 0x1f
sub eax, edx
mov ebx, eax
mov dword [esp], edi
call fcn.0040ad40
mov edx, dword [esp + 0x30]
mov dword [esp + 0x9c], eax
mov dword [esp + 0x60], edx
test eax, eax
jne 0x409848
mov eax, dword [edi + 0x10]
test eax, eax
je 0x4097b0
lea eax, [esp + 0x9c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040b8c0
mov ecx, dword [esp + 0x60]
fstp qword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add ecx, ebx
and edx, 0xfffff
mov dword [esp + 0x40], eax
or edx, 0x3ff00000
mov dword [esp + 0x4c], ecx
sub ecx, 1
mov dword [esp + 0x44], edx
fld qword [esp + 0x40]
mov eax, ecx
fsub dword [0x410f80]
mov dword [esp + 0x18], ecx
neg eax
fmul qword [str.aCoc]
mov ecx, eax
cmovs ecx, dword [esp + 0x18]
fadd qword [0x410f90]
fild dword [esp + 0x18]
fmul qword [0x410f98]
sub ecx, 0x435
faddp st(1)
test ecx, ecx
jle 0x4096fc
mov dword [esp + 0x50], ecx
fild dword [esp + 0x50]
fmul qword [0x410fa0]
faddp st(1)
fnstcw word [esp + 0x8e]
movzx ecx, word [esp + 0x8e]
or ch, 0xc
mov word [esp + 0x8c], cx
fldcw word [esp + 0x8c]
fist dword [esp + 0x50]
fldcw word [esp + 0x8e]
fldz
fcompi st(1)
ja 0x409e90
fstp st(0)
mov eax, dword [esp + 0x18]
shl eax, 0x14
lea eax, [eax + edx]
mov edx, ebx
sub edx, dword [esp + 0x18]
mov dword [esp + 0x44], eax
lea eax, [edx - 1]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x50]
cmp eax, 0x16
ja 0x409870
fld qword [eax*8 + 0x411000]
fst qword [esp + 0x18]
fld qword [esp + 0x40]
fxch st(1)
fcompi st(1)
fstp st(0)
jbe 0x409b28
sub eax, 1
mov dword [esp + 0x74], 0
mov dword [esp + 0x50], eax
jmp 0x409878
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call fcn.0040af80
mov eax, dword [esp + 0x24]
mov dword [eax], 1
mov eax, dword [esp + 0x28]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov dword [esp], 0x410f7d
call 0x409200
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x24]
mov dword [eax], 0xffff8000
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc8], 8
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc0], str.Infinity
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
jmp 0x409200
mov dword [edi + 0x10], 0
jmp 0x409647
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0040ac30
mov eax, dword [esp + 0x30]
add eax, dword [esp + 0x9c]
mov dword [esp + 0x60], eax
sub ebx, dword [esp + 0x9c]
jmp 0x409666
mov dword [esp + 0x74], 1
mov eax, dword [esp + 0x54]
mov dword [esp + 0x64], 0
test eax, eax
js 0x409e70
mov eax, dword [esp + 0x50]
test eax, eax
jns 0x409b44
mov eax, dword [esp + 0x50]
sub dword [esp + 0x64], eax
mov dword [esp + 0x50], 0
mov edx, eax
mov dword [esp + 0x6c], eax
neg edx
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x20]
cmp eax, 9
ja 0x409b60
cmp eax, 5
jg 0x409eb0
mov eax, dword [esp + 0x4c]
add eax, 0x3fd
cmp eax, 0x7f7
setbe al
movzx eax, al
mov dword [esp + 0x78], eax
cmp dword [esp + 0x20], 3
je 0x40a338
jle 0x409f10
cmp dword [esp + 0x20], 4
je 0x40a280
mov eax, dword [esp + 0x38]
add eax, dword [esp + 0x6c]
mov dword [esp + 0x7c], eax
add eax, 1
mov dword [esp + 0x4c], eax
mov dword [esp + 0x9c], eax
test eax, eax
jle 0x40a65c
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.004091c0
mov dword [esp + 0x68], 1
mov dword [esp + 0x18], eax
lea esi, cs:[esi]
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + 0xc]
sub ecx, 1
mov dword [esp + 0x58], ecx
je 0x409972
mov eax, 2
cmovns eax, ecx
and ebp, 8
mov dword [esp + 0x58], eax
mov edx, eax
je 0x409fc8
mov eax, 3
sub eax, edx
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x4c]
cmp eax, 0xe
setbe cl
and cl, byte [esp + 0x78]
je 0x409fc8
mov edx, dword [esp + 0x58]
or edx, dword [esp + 0x6c]
jne 0x409fc8
mov edx, dword [esp + 0x74]
fld qword [esp + 0x40]
mov dword [esp + 0x9c], 0
test edx, edx
je 0x4099b5
fld1
fcompi st(1)
ja 0x40a919
fld st(0)
fadd st(1)
fadd dword [0x410fbc]
fstp qword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x58], eax
mov eax, edx
sub eax, 0x3400000
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x409f8d
mov dword [esp + 0x80], 0
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x78]
mov ebp, dword [esp + 0x68]
fld qword [esp + 0x58]
fld qword [eax*8 + 0x410ff8]
test ebp, ebp
je 0x40a714
fxch st(2)
fnstcw word [esp + 0x8e]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x78]
movzx eax, word [esp + 0x8e]
lea ebp, [ecx + 1]
or ah, 0xc
mov word [esp + 0x8c], ax
fldcw word [esp + 0x8c]
fist dword [esp + 0x58]
fldcw word [esp + 0x8e]
fxch st(2)
fdivr dword [0x410fc4]
movzx eax, byte [esp + 0x58]
add eax, 0x30
mov byte [ecx], al
fsubrp st(1)
fild dword [esp + 0x58]
fsubp st(2)
fcomi st(1)
jbe 0x409acd
fstp st(0)
jmp 0x40a7da
mov eax, dword [esp + 0x9c]
add eax, 1
mov dword [esp + 0x9c], eax
cmp eax, edx
jge 0x409fb1
fld dword [0x410fb4]
add ebp, 1
fmul st(1), st(0)
fmulp st(2)
fxch st(1)
fldcw word [esp + 0x8c]
fist dword [esp + 0x58]
fldcw word [esp + 0x8e]
fild dword [esp + 0x58]
movzx eax, byte [esp + 0x58]
add eax, 0x30
fsubp st(1)
fxch st(1)
mov byte [ebp - 1], al
fcomi st(1)
ja 0x40a7d8
fld st(1)
fsubr dword [0x410fb0]
fxch st(1)
fcomi st(1)
fstp st(1)
jbe 0x409a78
fstp st(0)
fstp st(0)
movzx eax, byte [ebp - 1]
mov ecx, dword [esp + 0x18]
jmp 0x409afe
cmp edx, ecx
je 0x40aa29
movzx eax, byte [edx - 1]
mov ebp, edx
lea edx, [ebp - 1]
cmp al, 0x39
je 0x409af0
add eax, 1
mov dword [esp + 0x34], 0x20
mov byte [edx], al
mov eax, dword [esp + 0x80]
add eax, 1
mov dword [esp + 0x3c], eax
jmp 0x409e20
mov eax, dword [esp + 0x54]
mov dword [esp + 0x74], 0
mov dword [esp + 0x64], 0
test eax, eax
js 0x409e70
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x70], 0
add dword [esp + 0x54], ecx
mov dword [esp + 0x6c], ecx
jmp 0x4098b4
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], esi
fild dword [esp + 0x18]
fmul qword [0x410fa8]
fldcw word [esp + 0x8c]
fistp dword [esp + 0x18]
fldcw word [esp + 0x8e]
mov eax, dword [esp + 0x18]
add eax, 3
mov dword [esp], eax
mov dword [esp + 0x9c], eax
call fcn.004091c0
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x18], eax
test ecx, ecx
js 0x409ec4
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x6c]
cmp ecx, dword [eax + 0x14]
jle 0x40a533
mov dword [esp + 0x38], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x7c], 0xffffffff
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x60]
sub esi, ebx
lea ecx, [esi + 1]
mov eax, dword [eax + 4]
sub edx, esi
mov dword [esp + 0x9c], ecx
cmp edx, eax
jge 0x40a4d0
mov esi, dword [esp + 0x20]
lea edx, [esi - 3]
and edx, 0xfffffffd
je 0x40a4d0
mov edx, dword [esp + 0x60]
sub edx, eax
cmp esi, 1
mov esi, dword [esp + 0x4c]
lea ecx, [edx + 1]
setg dl
test esi, esi
mov dword [esp + 0x9c], ecx
setg al
test dl, al
je 0x409c3b
cmp ecx, esi
jg 0x40a4db
mov eax, dword [esp + 0x64]
add dword [esp + 0x54], ecx
mov ebp, dword [esp + 0x70]
mov dword [esp + 0x60], eax
add eax, ecx
mov dword [esp + 0x64], eax
mov dword [esp], 1
call fcn.0040b0d0
mov dword [esp + 0x68], 1
mov esi, eax
mov ecx, dword [esp + 0x60]
test ecx, ecx
jle 0x409c95
mov edx, dword [esp + 0x54]
test edx, edx
jle 0x409c95
cmp ecx, edx
mov eax, edx
cmovle eax, ecx
sub dword [esp + 0x64], eax
sub ecx, eax
sub edx, eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x70]
test eax, eax
je 0x409ce3
mov eax, dword [esp + 0x68]
test eax, eax
je 0x40a51c
test ebp, ebp
jle 0x409cd7
mov dword [esp], esi
mov dword [esp + 4], ebp
call fcn.0040b320
mov dword [esp + 4], edi
mov dword [esp], eax
mov esi, eax
call fcn.0040b180
mov dword [esp], edi
mov dword [esp + 0x40], eax
call fcn.0040af80
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x70]
sub eax, ebp
jne 0x40a520
mov dword [esp], 1
call fcn.0040b0d0
cmp ebx, 1
sete dl
cmp dword [esp + 0x20], 1
mov dword [esp + 0x40], eax
setle bl
and ebx, edx
mov edx, dword [esp + 0x50]
test edx, edx
jg 0x40a2d0
xor ebp, ebp
test bl, bl
jne 0x40a9b6
mov eax, dword [esp + 0x50]
mov ebx, 0x1f
test eax, eax
jne 0x40a2e6
sub ebx, dword [esp + 0x54]
mov edx, dword [esp + 0x64]
sub ebx, 4
and ebx, 0x1f
add edx, ebx
mov dword [esp + 0x9c], ebx
mov eax, ebx
test edx, edx
jle 0x409d5c
mov dword [esp], edi
mov dword [esp + 4], edx
call fcn.0040b500
mov edi, eax
mov eax, dword [esp + 0x9c]
add eax, dword [esp + 0x54]
test eax, eax
jle 0x409d78
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.0040b500
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x20], 2
setg dl
test eax, eax
jne 0x40a380
mov eax, dword [esp + 0x4c]
test eax, eax
jg 0x40a038
test dl, dl
je 0x40a038
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x40a299
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 0
mov dword [esp + 4], 5
mov dword [esp], eax
call fcn.0040aff0
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 0x40], eax
call fcn.0040b640
test eax, eax
jle 0x40a299
mov eax, dword [esp + 0x6c]
add eax, 2
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x18]
mov byte [eax], 0x31
lea ebp, [eax + 1]
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.0040af80
mov dword [esp + 0x34], 0x20
test esi, esi
jne 0x40a24c
jmp 0x409e20
fstp st(0)
fstp st(0)
lea esi, cs:[esi]
nop
mov eax, dword [esp + 0x18]
cmp ebp, dword [esp + 0x18]
ja 0x409e37
jmp 0x40ac1b
sub ebp, 1
cmp ebp, eax
je 0x409e3d
cmp byte [ebp - 1], 0x30
je 0x409e30
mov dword [esp], edi
call fcn.0040af80
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x3c]
mov byte [ebp], 0
mov dword [eax], edi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x409e5d
mov dword [eax], ebp
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x34]
or dword [eax], edi
jmp 0x40955e
mov eax, 1
mov dword [esp + 0x54], 0
sub eax, edx
mov dword [esp + 0x64], eax
jmp 0x40988c
fild dword [esp + 0x50]
fucompi st(1)
fstp st(0)
jp 0x409ea0
je 0x409734
sub dword [esp + 0x50], 1
jmp 0x409734
sub eax, 4
mov dword [esp + 0x78], 0
mov dword [esp + 0x20], eax
jmp 0x4098e2
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x60]
sub esi, ebx
mov dword [esp + 0x38], 0
lea ecx, [esi + 1]
mov dword [esp + 0x58], 0
mov eax, dword [eax + 4]
sub edx, esi
mov dword [esp + 0x9c], ecx
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x7c], 0xffffffff
cmp edx, eax
jge 0x409c3b
jmp 0x409c00
cmp dword [esp + 0x20], 2
jne 0x409b68
mov dword [esp + 0x68], 0
mov ecx, dword [esp + 0x38]
mov eax, 1
test ecx, ecx
cmovg eax, ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x4c], eax
mov dword [esp], eax
call fcn.004091c0
cmp dword [esp + 0x20], 1
mov dword [esp + 0x18], eax
jg 0x409940
mov dword [esp + 0x58], 0
jmp 0x409972
fld st(0)
fadd st(1)
fadd dword [0x410fbc]
fstp qword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x58], eax
mov eax, edx
sub eax, 0x3400000
mov dword [esp + 0x5c], eax
fsub dword [0x410fc0]
fld qword [esp + 0x58]
fxch st(1)
fcomi st(1)
ja 0x40a9cf
fxch st(1)
fchs
fcompi st(1)
fstp st(0)
ja 0x40a28f
jmp 0x409fbd
fstp st(0)
fstp st(0)
jmp 0x409fbd
fstp st(0)
jmp 0x409fbd
fstp st(0)
mov dword [esp + 0x58], 0
lea esi, [esi]
mov ecx, dword [esp + 0x60]
test ecx, ecx
js 0x40a260
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x6c]
cmp dword [edx + 0x14], eax
jl 0x40a260
mov edx, dword [esp + 0x38]
fld qword [eax*8 + 0x411000]
test edx, edx
jns 0x40a54e
mov esi, dword [esp + 0x4c]
test esi, esi
jg 0x40a54e
jne 0x40a28d
fmul dword [0x410fc0]
fld qword [esp + 0x40]
fxch st(1)
fcompi st(1)
fstp st(0)
jae 0x40a28f
add eax, 2
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], eax
jmp 0x409deb
mov eax, dword [esp + 0x6c]
add eax, 1
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x68]
test eax, eax
je 0x40a400
add ebx, dword [esp + 0x60]
test ebx, ebx
jle 0x40a065
mov dword [esp], esi
mov dword [esp + 4], ebx
call fcn.0040b500
mov esi, eax
mov dword [esp + 0x54], esi
test ebp, ebp
jne 0x40a970
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x54]
mov dword [esp + 0x38], eax
mov eax, 1
jmp 0x40a14d
mov dword [esp], edx
call fcn.0040af80
mov eax, 1
test ebx, ebx
js 0x40a807
or ebx, dword [esp + 0x20]
jne 0x40a0b8
mov ebx, dword [esp + 0x2c]
test byte [ebx], 1
je 0x40a807
mov ecx, dword [esp + 0x38]
lea ebx, [ecx + 1]
mov edx, ebx
test eax, eax
jle 0x40a0d0
cmp dword [esp + 0x58], 2
jne 0x40a9ea
movzx eax, byte [esp + 0x30]
mov byte [ebx - 1], al
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x9c], eax
je 0x40aa1c
mov dword [esp], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa
call fcn.0040aff0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa
mov edi, eax
mov dword [esp], esi
cmp esi, ebp
je 0x40a300
call fcn.0040aff0
mov dword [esp], ebp
mov dword [esp + 8], 0
mov esi, eax
mov dword [esp + 4], 0xa
call fcn.0040aff0
mov ebp, eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x38], ebx
add eax, 1
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x40]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004092a0
mov dword [esp + 4], esi
mov dword [esp], edi
mov ecx, eax
add ecx, 0x30
mov dword [esp + 0x50], eax
mov dword [esp + 0x30], ecx
call fcn.0040b640
mov dword [esp + 4], ebp
mov ebx, eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.0040b690
mov edx, eax
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x40a090
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 0x60], edx
call fcn.0040b640
mov edx, dword [esp + 0x60]
mov dword [esp + 0x54], eax
mov dword [esp], edx
call fcn.0040af80
mov eax, dword [esp + 0x54]
or eax, dword [esp + 0x20]
jne 0x40ac12
mov edx, dword [esp + 0x2c]
mov edx, dword [edx]
mov dword [esp + 0x54], edx
and edx, 1
or edx, dword [esp + 0x58]
jne 0x40a09d
cmp dword [esp + 0x30], 0x39
mov dword [esp + 0x54], ebp
mov ebp, dword [esp + 0x50]
je 0x40aaa9
test ebx, ebx
jle 0x40abeb
lea eax, [ebp + 0x31]
mov dword [esp + 0x34], 0x20
mov dword [esp + 0x30], eax
mov ebx, dword [esp + 0x38]
movzx eax, byte [esp + 0x30]
mov ecx, esi
mov esi, dword [esp + 0x54]
mov byte [ebx], al
lea ebp, [ebx + 1]
nop
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], ecx
mov dword [esp], eax
call fcn.0040af80
test esi, esi
je 0x409e20
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x40a24c
cmp ecx, esi
je 0x40a24c
mov dword [esp], ecx
call fcn.0040af80
mov dword [esp], esi
call fcn.0040af80
jmp 0x409e20
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x409bdf
mov eax, dword [esp + 0x64]
mov ebp, dword [esp + 0x70]
xor esi, esi
mov dword [esp + 0x60], eax
jmp 0x409c67
mov dword [esp + 0x68], 1
jmp 0x409f23
fstp st(0)
mov dword [esp + 0x40], 0
xor esi, esi
mov eax, dword [esp + 0x38]
neg eax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call fcn.0040af80
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x34], 0x10
mov eax, ebp
test esi, esi
jne 0x40a24c
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x18], eax
jmp 0x409e3d
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040b320
mov dword [esp + 0x40], eax
test bl, bl
jne 0x40a30e
xor ebp, ebp
mov ebx, dword [esp + 0x40]
mov eax, dword [ebx + 0x10]
bsr ebx, dword [ebx + eax*4 + 0x10]
xor ebx, 0x1f
jmp 0x409d2a
call fcn.0040aff0
mov esi, eax
mov ebp, eax
jmp 0x40a13f
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 4]
add eax, 1
cmp dword [esp + 0x30], eax
jle 0x40a2e4
add dword [esp + 0x64], 1
mov ebp, 1
add dword [esp + 0x54], 1
jmp 0x409d19
mov eax, dword [esp + 0x38]
add eax, dword [esp + 0x6c]
mov dword [esp + 0x7c], eax
add eax, 1
mov dword [esp + 0x4c], eax
mov dword [esp + 0x9c], eax
test eax, eax
jle 0x40a62a
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call fcn.004091c0
mov dword [esp + 0x68], 0
mov dword [esp + 0x18], eax
jmp 0x409940
mov eax, dword [esp + 0x40]
mov dword [esp], edi
mov byte [esp + 0x30], dl
mov dword [esp + 4], eax
call fcn.0040b640
movzx edx, byte [esp + 0x30]
test eax, eax
jns 0x409d8c
mov dword [esp], edi
mov eax, dword [esp + 0x6c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa
sub eax, 1
mov dword [esp + 0x3c], eax
call fcn.0040aff0
movzx edx, byte [esp + 0x30]
mov ecx, dword [esp + 0x68]
mov edi, eax
mov eax, dword [esp + 0x7c]
test eax, eax
setle al
and edx, eax
test ecx, ecx
jne 0x40ab23
test dl, dl
jne 0x40aacd
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x4c], eax
lea esi, [esi]
mov dword [esp + 0x20], esi
mov ebp, dword [esp + 0x18]
mov eax, 1
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x40]
jmp 0x40a444
mov dword [esp], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa
call fcn.0040aff0
mov edi, eax
mov eax, dword [esp + 0x9c]
add eax, 1
mov dword [esp + 4], esi
add ebp, 1
mov dword [esp], edi
mov dword [esp + 0x9c], eax
call fcn.004092a0
add eax, 0x30
mov byte [ebp - 1], al
cmp dword [esp + 0x9c], ebx
jl 0x40a420
mov dword [esp + 0x30], eax
mov esi, dword [esp + 0x20]
xor ecx, ecx
mov ebx, dword [esp + 0x58]
test ebx, ebx
je 0x40a67f
mov eax, dword [edi + 0x10]
cmp ebx, 2
je 0x40a6be
cmp eax, 1
jg 0x40a49b
mov ebx, dword [edi + 0x14]
test ebx, ebx
je 0x40a220
movzx edx, byte [ebp - 1]
mov ebx, dword [esp + 0x18]
jmp 0x40a4b6
cmp eax, ebx
je 0x40a666
movzx edx, byte [eax - 1]
mov ebp, eax
lea eax, [ebp - 1]
cmp dl, 0x39
je 0x40a4a8
add edx, 1
mov dword [esp + 0x34], 0x20
mov byte [eax], dl
jmp 0x40a220
cmp dword [esp + 0x20], 1
jle 0x409c3b
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x70]
sub eax, 1
cmp esi, eax
jl 0x40a647
sub esi, eax
mov ebp, esi
mov eax, dword [esp + 0x4c]
test eax, eax
js 0x40a8fd
mov esi, dword [esp + 0x64]
add dword [esp + 0x54], eax
mov dword [esp + 0x9c], eax
add eax, esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], eax
jmp 0x409c51
mov eax, dword [esp + 0x70]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040b320
mov edi, eax
jmp 0x409ce3
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x58], 0
mov dword [esp + 0x4c], 0xffffffff
fld qword [eax*8 + 0x411000]
fnstcw word [esp + 0x8e]
fld qword [esp + 0x40]
mov esi, dword [esp + 0x18]
mov dword [esp + 0x9c], 1
movzx eax, word [esp + 0x8e]
lea ebp, [esi + 1]
fld st(0)
fdiv st(2)
or ah, 0xc
mov word [esp + 0x8c], ax
fldcw word [esp + 0x8c]
fistp dword [esp + 0x20]
fldcw word [esp + 0x8e]
fild dword [esp + 0x20]
movzx eax, byte [esp + 0x20]
add eax, 0x30
fmul st(2)
mov byte [esi], al
mov eax, dword [esp + 0x6c]
add eax, 1
mov dword [esp + 0x3c], eax
fsubp st(1)
fldz
fxch st(1)
fucomi st(1)
fstp st(1)
jp 0x40a5c8
je 0x409e13
lea esi, [esi]
mov eax, dword [esp + 0x9c]
cmp eax, dword [esp + 0x4c]
je 0x40a6d5
fmul dword [0x410fb4]
add eax, 1
add ebp, 1
mov dword [esp + 0x9c], eax
fld st(0)
fdiv st(2)
fldcw word [esp + 0x8c]
fistp dword [esp + 0x20]
fldcw word [esp + 0x8e]
fild dword [esp + 0x20]
movzx eax, byte [esp + 0x20]
add eax, 0x30
fmul st(2)
mov byte [ebp - 1], al
fsubp st(1)
fldz
fxch st(1)
fucomi st(1)
fstp st(1)
jp 0x40a5c8
jne 0x40a5c8
fstp st(0)
fstp st(0)
jmp 0x409e20
mov dword [esp + 0x68], 0
mov dword [esp + 0x9c], 1
mov eax, 1
jmp 0x409f44
mov edx, eax
xor ebp, ebp
sub edx, dword [esp + 0x70]
mov dword [esp + 0x70], eax
add dword [esp + 0x50], edx
jmp 0x40a4f2
mov dword [esp + 0x68], 1
jmp 0x40a632
mov eax, dword [esp + 0x18]
add dword [esp + 0x3c], 1
mov dword [esp + 0x34], 0x20
mov byte [eax], 0x31
jmp 0x40a220
mov dword [esp], edi
mov dword [esp + 4], 1
mov dword [esp + 0x20], ecx
call fcn.0040b500
mov edi, eax
mov eax, dword [esp + 0x40]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040b640
mov ecx, dword [esp + 0x20]
test eax, eax
jg 0x40a49b
jne 0x40a6be
test byte [esp + 0x30], 1
jne 0x40a49b
cmp dword [edi + 0x10], 1
jle 0x40ab5f
mov dword [esp + 0x34], 0x10
jmp 0x40a220
mov eax, dword [esp + 0x58]
test eax, eax
je 0x40aae2
fstp st(0)
fstp st(0)
mov dword [esp + 0x34], 0x10
cmp eax, 1
jne 0x409e20
jmp 0x40a6fc
fstp st(0)
fstp st(0)
mov esi, dword [esp + 0x6c]
movzx eax, byte [ebp - 1]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x80], esi
jmp 0x409afe
fnstcw word [esp + 0x8e]
mov dword [esp + 0x84], edi
mov ebp, dword [esp + 0x18]
fmulp st(1)
mov dword [esp + 0x88], esi
mov edi, dword [esp + 0x78]
xor esi, esi
movzx eax, word [esp + 0x8e]
mov edx, 1
or ah, 0xc
mov word [esp + 0x8c], ax
fld st(1)
jmp 0x40a763
fmul dword [0x410fb4]
add edx, 1
mov esi, ecx
fldcw word [esp + 0x8c]
fist dword [esp + 0x58]
fldcw word [esp + 0x8e]
mov dword [esp + 0x9c], edx
mov eax, dword [esp + 0x58]
test eax, eax
je 0x40a78c
fild dword [esp + 0x58]
mov esi, ecx
fsubp st(1)
add ebp, 1
add eax, 0x30
mov byte [ebp - 1], al
mov edx, dword [esp + 0x9c]
cmp edx, edi
jne 0x40a758
mov ecx, esi
mov edi, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
test cl, cl
fcmove st(0), st(2)
fstp st(2)
fld dword [0x410fc4]
fld st(1)
fadd st(1)
fxch st(3)
fcomi st(3)
fstp st(3)
ja 0x40ab14
fsubrp st(1)
fcompi st(1)
jbe 0x409fb7
jmp 0x40a7da
fstp st(0)
fldz
xor eax, eax
mov edx, 1
fucompi st(1)
fstp st(0)
setp al
cmovne eax, edx
shl eax, 4
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x80]
add eax, 1
mov dword [esp + 0x3c], eax
jmp 0x409e20
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x54], ebp
mov ebp, dword [esp + 0x50]
test ecx, ecx
je 0x40aa41
cmp dword [edi + 0x10], 1
jle 0x40ab77
cmp dword [esp + 0x58], 2
je 0x40aa8f
mov ebx, esi
mov ebp, dword [esp + 0x38]
mov esi, dword [esp + 0x54]
jmp 0x40a8a6
movzx eax, byte [esp + 0x30]
mov dword [esp + 0x2c], ecx
mov byte [ecx - 1], al
mov dword [esp], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa
call fcn.0040aff0
mov dword [esp], edi
cmp ebx, esi
mov dword [esp + 8], 0
cmove ebx, eax
mov dword [esp + 4], 0xa
mov dword [esp + 0x20], eax
call fcn.0040aff0
mov edi, eax
mov eax, dword [esp + 0x40]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.004092a0
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x20]
add eax, 0x30
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0040b640
lea ecx, [ebp + 1]
test eax, eax
jg 0x40a840
mov eax, dword [esp + 0x30]
mov dword [esp + 0x54], esi
mov edx, esi
mov esi, ebx
mov dword [esp + 0x38], ebp
mov ebx, ecx
cmp eax, 0x39
je 0x40aab0
add eax, 1
mov dword [esp + 0x34], 0x20
mov ecx, esi
mov esi, edx
mov dword [esp + 0x30], eax
movzx eax, byte [esp + 0x30]
mov ebp, ebx
mov ebx, dword [esp + 0x38]
mov byte [ebx], al
jmp 0x40a220
mov dword [esp + 0x9c], 0
mov eax, dword [esp + 0x64]
sub eax, dword [esp + 0x4c]
mov dword [esp + 0x60], eax
jmp 0x409c51
test eax, eax
je 0x409f68
mov ebp, dword [esp + 0x7c]
test ebp, ebp
jle 0x409fbb
fmul dword [0x410fb4]
mov dword [esp + 0x78], ebp
mov dword [esp + 0x80], 0xffffffff
fld st(0)
fmul dword [0x410fb8]
fadd dword [0x410fbc]
fstp qword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x58], eax
mov eax, edx
sub eax, 0x3400000
mov dword [esp + 0x5c], eax
jmp 0x4099f9
mov eax, dword [esi + 4]
mov dword [esp], eax
call fcn.0040ae90
lea ecx, [eax + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x10]
mov dword [esp], ecx
lea edx, [eax*4 + 8]
lea eax, [esi + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [esp + 4], 1
mov dword [esp], ebx
call fcn.0040b500
mov dword [esp + 0x54], eax
jmp 0x40a071
mov eax, dword [esp + 0x3c]
mov eax, dword [eax + 4]
add eax, 1
cmp eax, dword [esp + 0x30]
jge 0x409d19
jmp 0x40a31e
fstp st(0)
fstp st(0)
mov dword [esp + 0x3c], 2
xor esi, esi
mov dword [esp + 0x40], 0
jmp 0x409deb
cmp dword [esp + 0x30], 0x39
mov dword [esp + 0x54], ebp
mov ebp, ebx
je 0x40aab0
movzx eax, byte [esp + 0x30]
mov ebx, dword [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x34], 0x20
mov esi, dword [esp + 0x54]
add eax, 1
mov byte [ebx], al
jmp 0x40a220
mov eax, ebp
mov ecx, esi
mov ebp, edx
mov esi, eax
jmp 0x40a473
mov eax, dword [esp + 0x18]
add dword [esp + 0x80], 1
mov byte [eax], 0x30
movzx eax, byte [ebp - 1]
jmp 0x409b05
test eax, eax
jle 0x40aa85
mov dword [esp], edi
mov dword [esp + 4], 1
call fcn.0040b500
mov edi, eax
mov eax, dword [esp + 0x40]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040b640
test eax, eax
jle 0x40abbd
cmp dword [esp + 0x30], 0x39
je 0x40aaa9
lea eax, [ebp + 0x31]
mov dword [esp + 0x58], 0x20
mov dword [esp + 0x30], eax
cmp dword [edi + 0x10], 1
jle 0x40ab9c
mov eax, dword [esp + 0x38]
mov ecx, esi
mov dword [esp + 0x34], 0x10
mov esi, dword [esp + 0x54]
lea ebx, [eax + 1]
jmp 0x40a8eb
mov eax, dword [esp + 0x38]
lea ebx, [eax + 1]
mov eax, dword [esp + 0x38]
mov ebp, ebx
mov ecx, esi
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x54]
mov edx, 0x39
mov byte [eax], 0x39
jmp 0x40a4b6
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x4c], eax
jmp 0x409da0
fadd st(0)
fcomi st(1)
ja 0x40a6f8
fucompi st(1)
fstp st(0)
mov dword [esp + 0x34], 0x10
jp 0x409e20
jne 0x409e20
test byte [esp + 0x20], 1
je 0x409e20
jmp 0x40a6fc
fstp st(0)
fstp st(0)
fstp st(0)
mov ecx, dword [esp + 0x18]
jmp 0x409afe
mov dword [esp], esi
mov dword [esp + 8], 0
mov dword [esp + 4], 0xa
mov byte [esp + 0x30], dl
call fcn.0040aff0
movzx edx, byte [esp + 0x30]
mov esi, eax
test dl, dl
jne 0x40aacd
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x4c], eax
jmp 0x40a04f
mov edx, dword [edi + 0x14]
mov eax, 0x10
test edx, edx
cmove eax, dword [esp + 0x34]
mov dword [esp + 0x34], eax
jmp 0x40a220
mov edx, dword [edi + 0x14]
test edx, edx
jne 0x40a825
test eax, eax
jg 0x40aa45
mov eax, dword [esp + 0x38]
mov ecx, esi
mov esi, dword [esp + 0x54]
lea ebx, [eax + 1]
jmp 0x40a8eb
mov ebp, dword [edi + 0x14]
mov ecx, esi
mov esi, dword [esp + 0x54]
test ebp, ebp
je 0x40abd7
mov eax, dword [esp + 0x38]
mov dword [esp + 0x34], 0x10
lea ebx, [eax + 1]
jmp 0x40a8eb
jne 0x40abca
test byte [esp + 0x30], 1
jne 0x40aa6f
mov dword [esp + 0x58], 0x20
jmp 0x40aa85
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x38]
lea ebx, [eax + 1]
jmp 0x40a8eb
cmp dword [edi + 0x10], 1
mov dword [esp + 0x34], 0x10
jg 0x40a20b
xor eax, eax
cmp dword [edi + 0x14], 0
setne al
shl eax, 4
mov dword [esp + 0x34], eax
jmp 0x40a20b
mov eax, dword [esp + 0x54]
jmp 0x40a09d
mov dword [esp + 0x18], ebp
jmp 0x40a2c1