Function at 0x40bcf0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x42af8c
mov eax, dword fs:[0]
push eax
mov eax, 0x1d8c
mov dword fs:[0], esp
call fcn.00410580
push ebx
push ebp
push esi
push edi
push 0xe78e
mov esi, ecx
call fcn.0040de90
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
lea eax, [esp + 0x12c]
push eax
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bd40
mov ebp, dword [esp + 0x1dac]
push 0
sub eax, edx
push eax
lea ecx, [esp + 0x12c]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
push ebp
mov ecx, esi
call fcn.0040b330
push 0xe78f
call fcn.0040de90
push eax
lea edx, [esp + 0x12c]
push edx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bd90
push 1
sub eax, edi
push eax
lea eax, [esp + 0x12c]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0x18]
call fcn.00403750
lea ecx, [esp + 0x120c]
push ecx
push 1
lea ecx, [esp + 0x20]
mov dword [esp + 0x1dac], 0
call fcn.00404da0
movzx edx, word [esp + 0x1212]
movzx eax, word [esp + 0x1210]
push edx
push eax
lea ecx, [esp + 0x121c]
push ecx
lea edx, [esp + 0x141e]
push edx
push 0x898
call fcn.0040de90
add esp, 4
push eax
lea eax, [esp + 0x34]
push eax
call ebx
lea eax, [esp + 0x38]
add esp, 0x18
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40be14
push 1
sub eax, edi
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0x42d570
lea edx, [esp + 0x24]
push 0x42c614
push edx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40be48
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
movzx ecx, word [esp + 0x120c]
push ecx
push 0xe76c
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d66c
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40be90
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
movzx ecx, word [esp + 0x120e]
push ecx
push 0xe76d
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d66c
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bed6
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0x1313]
push ecx
push 0xe76e
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d664
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
jmp 0x40bf20
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bf20
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
movzx ecx, word [esp + 0x1210]
push ecx
push 0xe76f
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d66c
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bf66
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
movzx ecx, word [esp + 0x1212]
push ecx
push 0xe770
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d66c
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bfb0
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0x1412]
push ecx
push 0xe768
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d664
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bff5
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea eax, [esp + 0x1b0b]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c018
sub eax, edx
mov dword [esp + 0x14], eax
je 0x40c06c
lea ecx, [esp + 0x1b0b]
push ecx
push 0xe769
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d664
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c053
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea eax, [esp + 0x1c0a]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c076
sub eax, edx
mov dword [esp + 0x14], eax
je 0x40c0ca
lea ecx, [esp + 0x1c0a]
push ecx
push 0xe76a
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d664
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c0b1
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea eax, [esp + 0x1d09]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c0d4
sub eax, edx
mov dword [esp + 0x14], eax
je 0x40c129
lea ecx, [esp + 0x1d09]
push ecx
push 0xe76b
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d65c
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c110
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0
push 1
lea ecx, [esp + 0x9e8]
push ecx
push 1
lea ecx, [esp + 0x28]
call fcn.00406450
lea edx, [esp + 0xbe6]
push edx
push 0x89f
call fcn.0040de90
add esp, 4
push eax
lea eax, [esp + 0x28]
push eax
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c167
push 1
sub eax, edi
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0x42d570
lea edx, [esp + 0x24]
push 0x42c614
push edx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edi, [eax + 1]
jmp 0x40c1a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c1a0
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov eax, dword [esp + 0x1102]
test eax, eax
je 0x40c2c5
mov eax, dword [esp + 0x10fe]
test eax, eax
je 0x40c1ea
push 0xe764
call fcn.0040de90
push eax
push 0x42d658
lea ecx, [esp + 0x2c]
push ecx
jmp 0x40c1ff
push 0xe765
call fcn.0040de90
push eax
push 0x42d658
lea edx, [esp + 0x2c]
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
jmp 0x40c210
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c210
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov eax, dword [esp + 0xfee]
test eax, eax
je 0x40c2ff
mov ecx, dword [esp + 0xfe2]
test ecx, ecx
mov dword [esp + 0x14], 0
jle 0x40c2ff
lea edi, [eax + 8]
lea ecx, [edi + 4]
push ecx
push 0xe790
call fcn.0040de90
mov edx, dword [edi]
mov ecx, dword [edi - 8]
add esp, 4
push eax
mov eax, dword [edi - 4]
push edx
push eax
push ecx
lea edx, [esp + 0x87c]
push str.qBr5
push edx
call ebx
lea eax, [esp + 0x884]
add esp, 0x1c
lea edx, [eax + 1]
jmp 0x40c290
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c290
push 1
sub eax, edx
push eax
lea eax, [esp + 0x870]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xfe2]
inc eax
add edi, 0x4c
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x40c252
jmp 0x40c2ff
push 0xe766
call fcn.0040de90
push eax
lea ecx, [esp + 0x28]
push 0x42d658
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c2e6
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0x42d570
lea eax, [esp + 0x24]
push 0x42c614
push eax
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c320
push 1
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0xe791
call fcn.0040de90
push eax
lea edx, [esp + 0x12c]
push edx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edi, [eax + 1]
jmp 0x40c360
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c360
push 1
sub eax, edi
push eax
lea eax, [esp + 0x12c]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0xff6]
push ecx
push 0x8a0
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push edx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c3a3
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0x42d570
lea ecx, [esp + 0x24]
push 0x42c614
push ecx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c3d7
push 1
sub eax, edi
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov eax, dword [esp + 0xff2]
test eax, eax
jne 0x40c436
push 0xe792
call fcn.0040de90
push eax
lea eax, [esp + 0x28]
push 0x42d658
push eax
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c420
push 1
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ecx
jmp 0x40cf63
mov edx, dword [esp + 0x10f6]
mov eax, dword [edx + 4]
lea ecx, [esp + 0x110a]
push ecx
lea edx, [esp + 0x24]
push 0x42d658
push edx
mov dword [esp + 0x1c], eax
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c462
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov eax, dword [esp + 0x1106]
test eax, eax
je 0x40c49d
push 0xe764
call fcn.0040de90
push eax
push 0x42d658
lea ecx, [esp + 0x2c]
push ecx
jmp 0x40c4b2
push 0xe765
call fcn.0040de90
push eax
push 0x42d658
lea edx, [esp + 0x2c]
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c4c0
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x10f6]
mov edx, dword [ecx + 0x24]
push edx
push 0xe76d
call fcn.0040de90
add esp, 4
push eax
lea eax, [esp + 0x28]
push 0x42d63c
push eax
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c508
push 1
sub eax, edi
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov edx, dword [esp + 0x10f6]
mov eax, dword [edx + 0x18]
push eax
push 0xe76f
call fcn.0040de90
add esp, 4
push eax
lea ecx, [esp + 0x28]
push 0x42d63c
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c550
push 1
sub eax, edi
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov eax, dword [esp + 0x10f6]
mov ecx, dword [eax + 0x1c]
push ecx
push 0xe770
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d63c
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c598
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x10f6]
mov edx, dword [ecx + 0x20]
push edx
push 0xe771
call fcn.0040de90
add esp, 4
push eax
lea eax, [esp + 0x28]
push 0x42d63c
push eax
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c5e0
push 1
sub eax, edi
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov edx, dword [esp + 0x10f6]
mov eax, dword [edx + 8]
push eax
push 0xe794
call fcn.0040de90
mov ecx, dword [esp + 0x10fe]
mov edx, dword [ecx]
add esp, 4
push eax
push edx
push 0xe793
call fcn.0040de90
add esp, 4
push eax
lea eax, [esp + 0x30]
push str.qBr5F
push eax
call ebx
lea eax, [esp + 0x38]
add esp, 0x18
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c640
push 1
sub eax, edi
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov edx, dword [esp + 0x10f6]
movzx eax, word [edx + 0x2c]
push eax
push 0xe796
call fcn.0040de90
mov ecx, dword [esp + 0x10fe]
mov edx, dword [ecx + 0x28]
add esp, 4
push eax
push edx
push 0xe795
call fcn.0040de90
add esp, 4
push eax
lea eax, [esp + 0x30]
push 0x42d618
push eax
call ebx
lea eax, [esp + 0x38]
add esp, 0x18
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c6a2
push 1
sub eax, edi
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov edx, dword [esp + 0x10f6]
mov eax, dword [edx + 0x14]
push eax
push 0xe799
call fcn.0040de90
mov ecx, dword [esp + 0x10fe]
mov edx, dword [ecx + 0x10]
add esp, 4
push eax
push edx
push 0xe798
call fcn.0040de90
add esp, 4
push eax
mov eax, dword [esp + 0x1106]
mov ecx, dword [eax + 0xc]
push ecx
push 0xe797
call fcn.0040de90
add esp, 4
push eax
push 0xe774
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x3c]
push 0x42d5f4
push edx
call ebx
lea eax, [esp + 0x44]
add esp, 0x24
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c730
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov edx, dword [esp + 0x10f6]
mov eax, dword [edx + 0x3c]
xor ecx, ecx
test eax, eax
setne cl
push ecx
push 0xe775
call fcn.0040de90
add esp, 4
push eax
lea eax, [esp + 0x28]
push 0x42d66c
push eax
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c780
push 1
sub eax, edi
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov eax, dword [esp + 0x10f6]
mov ecx, dword [eax + 0x40]
xor edx, edx
test ecx, ecx
setne dl
push edx
push 0xe776
call fcn.0040de90
add esp, 4
push eax
lea ecx, [esp + 0x28]
push 0x42d66c
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c7d0
push 1
sub eax, edi
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x10f6]
mov edx, dword [ecx + 0x44]
xor eax, eax
test edx, edx
setne al
push eax
push 0xe777
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d66c
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c820
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
test byte [esp + 0x10], 0xf
jne 0x40c87a
push 0xe778
call fcn.0040de90
push eax
lea ecx, [esp + 0x28]
push 0x42d658
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c861
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
test byte [esp + 0x10], 1
je 0x40c8be
push 1
call fcn.0040de90
push eax
lea eax, [esp + 0x28]
push 0x42d658
push eax
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c8a0
push 1
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xfffffffe
test byte [esp + 0x10], 2
je 0x40c901
push 2
call fcn.0040de90
push eax
lea edx, [esp + 0x28]
push 0x42d658
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c8e3
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xfffffffd
test byte [esp + 0x10], 0x10
je 0x40c94e
push 0xe77b
call fcn.0040de90
push eax
lea ecx, [esp + 0x28]
push 0x42d658
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c930
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffffffef
test byte [esp + 0x10], 0x20
je 0x40c991
push 0x20
call fcn.0040de90
push eax
lea eax, [esp + 0x28]
push 0x42d658
push eax
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c973
push 1
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffffffdf
test byte [esp + 0x10], 0x40
je 0x40c9de
push 0xe77d
call fcn.0040de90
push eax
lea edx, [esp + 0x28]
push 0x42d658
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c9c0
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffffffbf
mov al, byte [esp + 0x10]
test al, al
jns 0x40ca28
push 0xe77e
call fcn.0040de90
push eax
lea ecx, [esp + 0x28]
push 0x42d658
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ca07
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffffff7f
mov eax, dword [esp + 0x10]
test ah, 1
je 0x40ca73
push 0xe77f
call fcn.0040de90
push eax
lea eax, [esp + 0x28]
push 0x42d658
push eax
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ca52
push 1
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xfffffeff
mov eax, dword [esp + 0x10]
test ah, 2
je 0x40cac1
push 0xe780
call fcn.0040de90
push eax
lea edx, [esp + 0x28]
push 0x42d658
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40caa0
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xfffffdff
mov eax, dword [esp + 0x10]
test ah, 4
je 0x40cb11
push 0xe781
call fcn.0040de90
push eax
lea ecx, [esp + 0x28]
push 0x42d658
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
jmp 0x40caf0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40caf0
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xfffffbff
mov eax, dword [esp + 0x10]
and eax, 0x3000
cmp eax, 0x3000
jne 0x40cb63
push 0xe782
call fcn.0040de90
push eax
lea ecx, [esp + 0x28]
push 0x42d658
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cb42
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffffcfff
mov eax, dword [esp + 0x10]
test ah, 0x10
je 0x40cbb1
push 0xe783
call fcn.0040de90
push eax
lea eax, [esp + 0x28]
push 0x42d658
push eax
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cb90
push 1
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffffefff
mov eax, dword [esp + 0x10]
test ah, 0x20
je 0x40cc01
push 0xe784
call fcn.0040de90
push eax
lea edx, [esp + 0x28]
push 0x42d658
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
jmp 0x40cbe0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cbe0
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffffdfff
mov ecx, dword [esp + 0x10]
and ecx, 0xc000
cmp ecx, 0xc000
jne 0x40cc55
push 0xe785
call fcn.0040de90
push eax
lea edx, [esp + 0x28]
push 0x42d658
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cc34
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffff3fff
mov eax, dword [esp + 0x10]
test ah, 0x40
je 0x40cca1
push 0xe786
call fcn.0040de90
push eax
lea ecx, [esp + 0x28]
push 0x42d658
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cc80
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffffbfff
mov eax, dword [esp + 0x10]
test ah, ah
jns 0x40ccf1
push 0xe787
call fcn.0040de90
push eax
lea eax, [esp + 0x28]
push 0x42d658
push eax
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ccd0
push 1
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xffff7fff
test dword [esp + 0x10], 0x10000
je 0x40cd41
push 0xe788
call fcn.0040de90
push eax
lea edx, [esp + 0x28]
push 0x42d658
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cd20
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
and dword [esp + 0x10], 0xfffeffff
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40cd89
push 0xe789
call fcn.0040de90
push eax
lea ecx, [esp + 0x28]
push 0x42d658
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cd70
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov edi, dword [esp + 0x10fa]
test edi, edi
mov dword [esp + 0x10], edi
jge 0x40ce36
lea ecx, [esp + 0x18]
call fcn.00404900
mov ecx, edi
neg ecx
cmp ecx, eax
jg 0x40cdfc
lea edx, [esp + 0x868]
or eax, 0xffffffff
push edx
sub eax, edi
push eax
lea ecx, [esp + 0x20]
call fcn.004045d0
lea ecx, [esp + 0x868]
push ecx
push 0xe78a
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push edx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 1]
jmp 0x40cdf0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cdf0
jmp 0x40cf59
push edi
push 0xe78b
call fcn.0040de90
add esp, 4
push eax
lea ecx, [esp + 0x28]
push ecx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ce20
sub eax, edx
push 1
push eax
lea edx, [esp + 0x28]
push edx
jmp 0x40cf63
jle 0x40cf6b
push 0xe78c
call fcn.0040de90
add esp, 4
push eax
push 0xe78a
call fcn.0040de90
add esp, 4
push eax
lea eax, [esp + 0x28]
push eax
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ce70
push 1
sub eax, edx
push eax
lea ecx, [esp + 0x28]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 1
xor edi, edi
call fcn.00404910
test eax, eax
jle 0x40cf2a
mov edx, dword [esp + 0x10]
test dword [esp + 0x14], edx
je 0x40cf00
lea eax, [esp + 0x868]
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.00404920
lea ecx, [esp + 0x868]
push ecx
push 0xe78a
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push edx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cee7
push 1
sub eax, edx
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ecx, eax
not ecx
and edx, ecx
shl eax, 1
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
inc edi
call fcn.00404910
cmp edi, eax
jl 0x40cea4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40cf6b
push eax
push 0xe78d
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push edx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cf52
sub eax, edx
push 1
push eax
lea eax, [esp + 0x28]
push eax
mov ecx, esi
push ebp
call fcn.0040b1d0
push 0x42d570
lea ecx, [esp + 0x24]
push 0x42c614
push ecx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cf86
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0xe791
call fcn.0040de90
push eax
lea eax, [esp + 0x12c]
push eax
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cfc1
push 1
sub eax, edi
push eax
lea ecx, [esp + 0x12c]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0xe79a
call fcn.0040de90
push eax
lea edx, [esp + 0x12c]
push edx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d000
push 1
sub eax, edi
push eax
lea eax, [esp + 0x12c]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0x424]
call fcn.004010e0
lea ecx, [esp + 0x424]
mov byte [esp + 0x1da4], 1
call fcn.00401390
test eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
jle 0x40d111
xor eax, eax
push 1
lea ecx, [esp + 0x96c]
push ecx
push eax
lea ecx, [esp + 0x430]
call fcn.004013d0
mov eax, dword [esp + 0x978]
movzx edx, al
shr eax, 8
push edx
movzx eax, al
push eax
lea ecx, [esp + 0x9c0]
push ecx
push 0xb58
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x334]
push edx
call ebx
lea eax, [esp + 0x338]
add esp, 0x14
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d0a8
push 1
sub eax, edi
push eax
lea eax, [esp + 0x32c]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0x42d570
lea ecx, [esp + 0x24]
push 0x42c614
push ecx
call ebx
lea eax, [esp + 0x2c]
add esp, 0xc
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d0e0
push 1
sub eax, edi
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
inc eax
mov dword [esp + 0x14], eax
movsx eax, ax
cmp eax, ecx
jl 0x40d052
lea ecx, [esp + 0x424]
call fcn.00401860
lea ecx, [esp + 0x424]
call fcn.004016f0
mov edi, 1
cmp eax, edi
mov dword [esp + 0x14], eax
jle 0x40d80e
mov eax, edi
lea esp, [esp]
lea ecx, [esp + 0x4fc]
push ecx
push eax
lea ecx, [esp + 0x42c]
call fcn.00401790
lea edx, [esp + 0x6fe]
push edx
lea eax, [esp + 0x504]
push eax
push 0xe745
call fcn.0040de90
add esp, 4
push eax
lea ecx, [esp + 0x2c]
push 0x42d5e8
push ecx
call ebx
lea eax, [esp + 0x34]
add esp, 0x14
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d190
push 1
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x14]
inc edi
movsx eax, di
cmp eax, ecx
jl 0x40d140
mov eax, ecx
cmp eax, 1
jle 0x40d80e
mov eax, dword [esp + 0x802]
test eax, eax
push 0x42d570
je 0x40d1ea
push 0xe75a
call fcn.0040de90
add esp, 4
push eax
push str._s__s
lea eax, [esp + 0x2c]
push eax
jmp 0x40d202
push 0xe75b
call fcn.0040de90
add esp, 4
push eax
push str._s__s
lea ecx, [esp + 0x2c]
push ecx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d210
sub eax, edx
push 1
push eax
lea edx, [esp + 0x28]
push edx
mov eax, edx
push eax
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x80a]
push ecx
push 0xe79f
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5dc
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d257
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x80e]
push ecx
push 0xe746
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d2a0
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x812]
push ecx
push 0xe747
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d2e5
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x816]
push ecx
push 0xe748
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d330
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x81a]
push ecx
push 0xe749
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d375
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x81e]
push ecx
push 0xe74a
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d3c0
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x822]
push ecx
push 0xe74b
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d405
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x826]
push ecx
push 0xe74c
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d450
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x82a]
push ecx
push 0xe74d
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d495
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x812]
push ecx
push 0xe74e
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d4e0
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x832]
push ecx
push 0xe74f
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d525
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x836]
push ecx
push 0xe750
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d570
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x83a]
push ecx
push 0xe751
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d5b5
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x83e]
push ecx
push 0xe752
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d600
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x842]
push ecx
push 0xe753
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d645
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x846]
push ecx
push 0xe754
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d690
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x84a]
push ecx
push 0xe755
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d6d5
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x84e]
push ecx
push 0xe756
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d720
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x852]
push ecx
push 0xe757
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d765
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x856]
push ecx
push 0xe758
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d7b0
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
mov ecx, dword [esp + 0x85a]
push ecx
push 0xe759
call fcn.0040de90
add esp, 4
push eax
lea edx, [esp + 0x28]
push 0x42d5d0
push edx
call ebx
lea eax, [esp + 0x30]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d7f5
push 1
sub eax, edi
push eax
lea eax, [esp + 0x28]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0xe791
call fcn.0040de90
push eax
lea ecx, [esp + 0x12c]
push ecx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d830
push 1
sub eax, edx
push eax
lea edx, [esp + 0x12c]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
push 0x96a
call fcn.0040de90
push eax
lea eax, [esp + 0x12c]
push eax
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d870
push 1
sub eax, edi
push eax
lea ecx, [esp + 0x12c]
push ecx
push ebp
mov ecx, esi
call fcn.0040b1d0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp byte [edi], 0
je 0x40d902
lea esp, [esp]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d8a5
push 1
sub eax, edx
push eax
push edi
push ebp
mov ecx, esi
call fcn.0040b1d0
lea edx, [esp + 0x124]
push 0x42d570
push edx
call ebx
lea eax, [esp + 0x12c]
add esp, 8
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40d8d6
sub eax, ecx
push 1
push eax
lea eax, [esp + 0x12c]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [edi + eax + 1]
cmp byte [edi], 0
jne 0x40d8a0
push 0xe791
call fcn.0040de90
push eax
lea ecx, [esp + 0x12c]
push ecx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d924
push 1
sub eax, edx
push eax
lea edx, [esp + 0x12c]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0x120]
call fcn.00401ad0
push 0
lea ecx, [esp + 0x124]
mov byte [esp + 0x1da8], 2
call fcn.004031a0
cmp eax, 1
je 0x40db2e
push 0
lea ecx, [esp + 0x18]
call fcn.0040e100
lea eax, [esp + 0x324]
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x1da8], 3
call fcn.0040e110
lea edi, [esp + 0x324]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40d997
mov ecx, dword [0x42d5c4]
mov edx, dword [0x42d5c8]
mov eax, dword [0x42d5cc]
mov dword [edi], ecx
mov dword [edi + 4], edx
push 0xe79b
mov dword [edi + 8], eax
call fcn.0040de90
push eax
lea ecx, [esp + 0x12c]
push ecx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40d9e0
push 1
sub eax, edx
push eax
lea edx, [esp + 0x12c]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
lea eax, [esp + 0x324]
push eax
push ebp
mov ecx, esi
call fcn.0040b2b0
push 0xe791
call fcn.0040de90
push eax
lea ecx, [esp + 0x12c]
push ecx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40da30
push 1
sub eax, edi
push eax
lea edx, [esp + 0x12c]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
lea eax, [esp + 0x324]
push eax
lea ecx, [esp + 0x18]
call fcn.0040e110
lea edi, [esp + 0x324]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40da65
mov ecx, dword [0x42d5b4]
mov edx, dword [0x42d5b8]
mov eax, dword [0x42d5bc]
mov dword [edi], ecx
mov cx, word [0x42d5c0]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
push 0xe79c
mov word [edi + 0xc], cx
call fcn.0040de90
push eax
lea edx, [esp + 0x12c]
push edx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40dab3
push 1
sub eax, edx
push eax
lea eax, [esp + 0x12c]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0x324]
push ecx
push ebp
mov ecx, esi
call fcn.0040b2b0
push 0xe791
call fcn.0040de90
push eax
lea edx, [esp + 0x12c]
push edx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40db01
push 1
sub eax, edi
push eax
lea eax, [esp + 0x12c]
push eax
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0x14]
mov byte [esp + 0x1da4], 2
call fcn.00401b90
push 0x96b
call fcn.0040de90
push eax
lea ecx, [esp + 0x12c]
push ecx
call ebx
lea eax, [esp + 0x130]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40db50
push 1
sub eax, edx
push eax
lea edx, [esp + 0x12c]
push edx
push ebp
mov ecx, esi
call fcn.0040b1d0
lea ecx, [esp + 0x120]
mov byte [esp + 0x1da4], 1
call fcn.00401b90
lea ecx, [esp + 0x424]
mov byte [esp + 0x1da4], 0
call fcn.00401190
lea ecx, [esp + 0x18]
mov dword [esp + 0x1da4], 0xffffffff
call fcn.00403760
mov ecx, dword [esp + 0x1d9c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1d98
ret 4