Function at 0x435590
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
lea eax, [esp - 0x3c]
cmp eax, dword [ecx + 8]
jbe 0x4368aa
sub esp, 0xbc
mov ecx, dword [esp + 0xc0]
test byte [ecx], al
mov edx, dword [esp + 0xc8]
test edx, edx
jl 0x4368a3
cmp edx, 0x10000
ja 0x4368a3
mov ebx, dword [esp + 0xc4]
test byte [ebx], al
mov ebp, edx
shl edx, 1
lea esi, [ebp - 0x20000]
xchg esi, ebx
neg ebx
xchg esi, ebx
mov eax, esi
xchg esi, ebx
neg ebx
xchg esi, ebx
sar esi, 0x1f
and edx, esi
lea esi, [ebx + edx]
cmp ebp, eax
ja 0x43689c
mov dword [esp + 0x50], edx
mov dword [esp + 0x74], esi
xor eax, eax
jmp 0x43561f
inc eax
mov edx, edi
mov ebx, dword [esp + 0xc4]
mov esi, dword [esp + 0x74]
cmp eax, ebp
jge 0x435693
jae 0x436895
mov edi, edx
lea edx, [eax + eax*2]
lea esi, [ecx + edx*8]
shl edx, 3
mov ebx, dword [ecx + edx]
test ebx, ebx
jne 0x435611
movzx edx, word [ecx + edx + 8]
cmp dx, 3
je 0x435611
mov edx, dword [0x8a6100]
test edx, edx
jne 0x43566a
mov edx, edi
mov edi, esi
mov ebx, eax
xor eax, eax
call fcn.0044d18a
mov eax, ebx
mov ecx, dword [esp + 0xc0]
mov edi, edx
jmp 0x435611
mov dword [esp + 0x34], eax
lea eax, [0x665820]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.0040f980
xor eax, eax
mov edx, dword [esp + 0x50]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0xc8]
jmp 0x43565d
mov edi, dword [0x8a5f64]
test edi, edi
xchg edi, ebx
sete bl
xchg edi, ebx
mov eax, edx
seta dl
mov esi, dword [0x8a5f60]
test esi, esi
xchg esi, ebx
seta bl
xchg esi, ebx
and esi, edi
or esi, edx
xchg esi, eax
test al, al
xchg esi, eax
jne 0x436765
xor edx, edx
xor esi, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], esi
mov edi, 1
jmp 0x4356fb
mov word [ecx + edi*2], bx
mov word [ecx + edx*2], di
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0xc0]
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0xc4]
mov edi, esi
mov esi, dword [esp + 0x24]
cmp edi, ebp
jge 0x43577a
mov dword [esp + 0x38], edi
mov edx, dword fs:[0x14]
mov edx, dword [edx]
mov edx, dword [edx + 0x18]
lea esi, [edi + 1]
mov ecx, dword [edx + 0x90]
mov dword [esp + 0x28], ecx
mov edi, dword [edx + 0x94]
shl ecx, 0x11
mov ebx, dword [esp + 0x28]
xor ecx, ebx
mov ebx, edi
xor edi, ecx
shr ecx, 7
xor ecx, edi
mov edi, ebx
shr ebx, 0x10
xor ebx, ecx
lea ecx, [edi + ebx]
mov eax, ecx
mov ecx, edx
mul esi
nop
nop
mov dword [ecx + 0x90], edi
mov dword [ecx + 0x94], ebx
cmp edx, ebp
jae 0x436887
mov ecx, dword [esp + 0xc4]
movzx ebx, word [ecx + edx*2]
mov edi, dword [esp + 0x38]
cmp edi, ebp
jb 0x4356d7
jmp 0x436887
mov edi, dword [esp + 0x74]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x54]
jmp 0x435821
mov word [edi + edx*2], bx
mov eax, dword [esp + 0x8c]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0xc4]
mov esi, dword [esp + 0x8c]
test edx, edx
jle 0x4357f5
lea eax, [edx - 1]
shr eax, 0x1f
lea eax, [edx + eax - 1]
sar eax, 1
cmp eax, ebp
jae 0x436879
mov dword [esp + 0x4c], eax
movzx ebx, word [edi + eax*2]
movzx eax, bx
cmp eax, ebp
jae 0x436879
lea eax, [eax + eax*2]
shl eax, 3
mov eax, dword [ecx + eax]
nop
nop
cmp eax, esi
jae 0x4357f5
cmp edx, ebp
jb 0x435791
jmp 0x436872
mov eax, dword [esp + 0x2c]
mov ebx, dword [esp + 0xc4]
movzx esi, word [ebx + eax*2]
cmp edx, ebp
jae 0x43686b
mov word [edi + edx*2], si
inc eax
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x2c]
cmp edx, ebp
jge 0x435850
jae 0x436880
movzx esi, word [ebx + edx*2]
cmp esi, ebp
jae 0x436880
lea esi, [esi + esi*2]
shl esi, 3
mov esi, dword [ecx + esi]
mov dword [esp + 0x8c], esi
jmp 0x4357b2
lea edx, [ebp - 1]
jmp 0x435944
mov word [edi + eax*2], bx
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x88]
mov edx, eax
mov ebx, dword [esp + 0xc4]
mov eax, esi
mov esi, dword [esp + 0x88]
mov dword [esp + 0x30], eax
shl eax, 1
lea ebx, [eax + 1]
cmp ebx, edx
jge 0x435919
lea esi, [eax + 2]
cmp esi, edx
jge 0x435987
cmp ebx, ebp
jae 0x436856
movzx edx, word [edi + eax*2 + 2]
cmp edx, ebp
jae 0x436856
lea edx, [edx + edx*2]
shl edx, 3
mov edx, dword [edx + ecx]
nop
cmp esi, ebp
jae 0x436856
movzx eax, word [edi + eax*2 + 4]
cmp eax, ebp
jae 0x436856
lea eax, [eax + eax*2]
shl eax, 3
mov eax, dword [eax + ecx]
nop
cmp edx, eax
jae 0x435987
nop
mov eax, dword [esp + 0x88]
cmp esi, ebp
jae 0x43684f
movzx ebx, word [edi + esi*2]
movzx edx, bx
cmp edx, ebp
jae 0x43684f
lea edx, [edx + edx*2]
shl edx, 3
mov edx, dword [ecx + edx]
nop
cmp eax, edx
jae 0x435919
mov eax, dword [esp + 0x30]
cmp eax, ebp
jb 0x435858
jmp 0x436848
mov eax, dword [esp + 0x30]
cmp eax, ebp
jae 0x436841
movzx edx, word [esp + 0x1c]
mov word [edi + eax*2], dx
mov eax, dword [esp + 0x3c]
lea edx, [eax - 1]
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0xc4]
mov esi, dword [esp + 0x24]
test edx, edx
jl 0x43598e
cmp edx, ebp
jae 0x436864
movzx esi, word [edi + edx*2]
mov word [esp + 0x1c], si
movzx esi, si
cmp esi, ebp
jae 0x43685d
mov dword [esp + 0x3c], edx
lea esi, [esi + esi*2]
shl esi, 3
mov esi, dword [ecx + esi]
mov dword [esp + 0x88], esi
movzx eax, word [ebx + eax]
mov word [edi + edx*2], ax
xor eax, eax
jmp 0x435879
mov esi, ebx
jmp 0x4358db
mov dword [esp], ecx
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
call fcn.00435390
jmp 0x43669c
inc eax
mov ecx, dword [esp + 0xc8]
mov ebx, edi
mov dword [esp + 0x44], esi
mov dword [esp + 0x7c], ebp
cmp eax, ecx
jge 0x435e30
jae 0x43683a
mov edi, ebx
movzx ebx, word [ebx + eax*2]
cmp ebx, ecx
jae 0x436833
mov dword [esp + 0x40], eax
mov dword [esp + 0x50], ebx
lea ecx, [ebx + ebx*2]
lea ebx, [edx + ecx*8]
mov dword [esp + 0x9c], ebx
shl ecx, 3
mov dword [esp + 0x4c], ecx
mov ebx, dword [edx + ecx]
mov dword [esp + 0x84], ebx
movzx ecx, word [edx + ecx + 8]
cmp cx, 1
ja 0x435ca0
test cx, cx
je 0x4359af
test byte [ebx], al
lea eax, [ebx + 0x28]
mov dword [esp], eax
call fcn.00404fc0
mov eax, dword [esp + 4]
test eax, eax
jne 0x435bfa
mov ecx, dword [esp + 0x84]
mov edx, dword [ecx]
test edx, edx
ja 0x435b45
mov edx, dword [ecx + 0x10]
test edx, edx
jne 0x435a6b
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0xc0]
mov edi, dword [esp + 0xc4]
mov ebp, eax
mov esi, ecx
mov eax, dword [esp + 0x40]
jmp 0x4359af
mov eax, dword [esp + 0xc0]
mov dword [esp], eax
mov ecx, dword [esp + 0xc8]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x74]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
call fcn.00435420
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0xc0]
mov eax, dword [ecx + eax + 4]
test eax, eax
jne 0x435b2a
mov eax, dword [esp + 0x9c]
xor ecx, ecx
mov edx, dword [esp + 0x50]
mov ebx, dword [eax + 0x14]
test ebx, ebx
xchg ebp, ebx
setg bl
xchg ebp, ebx
xchg esi, ebx
sete bl
xchg esi, ebx
mov eax, dword [eax + 0x10]
test eax, eax
xchg edi, ebx
seta bl
xchg edi, ebx
and edi, esi
or edi, ebp
xchg edi, eax
test al, al
xchg edi, eax
jne 0x435af7
mov dword [esp + 0xcc], edx
mov byte [esp + 0xd0], cl
add esp, 0xbc
ret
mov byte [esp + 0x1b], cl
mov dword [esp + 0x44], edx
mov ecx, dword [esp + 0x20]
sub eax, ecx
mov dword [esp], eax
mov eax, dword [esp + 0x24]
sbb ebx, eax
mov dword [esp + 4], ebx
mov dword [esp + 8], 1
call fcn.004229a0
movzx ecx, byte [esp + 0x1b]
mov edx, dword [esp + 0x44]
jmp 0x435ae2
mov ecx, dword [esp + 0x84]
mov ecx, dword [ecx + 0x14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.0040f980
jmp 0x435aac
nop
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0xc0]
mov eax, dword [edx + eax + 4]
nop
movzx ebx, word [ecx + 0xc]
imul ebx, dword [ecx + 0x1c]
add ebx, dword [ecx + 8]
test eax, eax
jne 0x435bd3
mov eax, dword [ecx + 0x14]
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.0040f980
mov eax, dword [esp + 0x84]
mov ecx, dword [eax + 0x1c]
inc ecx
mov dword [eax + 0x1c], ecx
cmp dword [eax + 4], ecx
jne 0x435b8e
mov dword [eax + 0x1c], 0
dec dword [eax]
mov eax, dword [esp + 0xc0]
mov dword [esp], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call fcn.00435420
mov eax, dword [esp + 0x9c]
mov ecx, 1
mov edx, dword [esp + 0x50]
jmp 0x435ab9
mov dword [esp + 0x5c], ebx
mov edx, dword [ecx + 0x14]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], ebx
call fcn.0040f580
mov ecx, dword [esp + 0x84]
mov ebx, dword [esp + 0x5c]
jmp 0x435b65
mov dword [esp + 0x6c], eax
lea edi, [esp + 0xa0]
xor eax, eax
call fcn.0044d189
lea ecx, [0x44b190]
mov dword [esp + 0xa0], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0xa4], ecx
mov edx, dword [esp + 0xc8]
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], edx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], edx
mov dword [esp + 0xb8], edx
mov edx, dword [esp + 0x4c]
mov ecx, dword [ecx + edx + 4]
mov edx, dword [esp + 0x84]
mov dword [esp], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 2
call fcn.00404d60
mov eax, dword [esp + 0x9c]
mov ecx, 1
mov edx, dword [esp + 0x50]
jmp 0x435ab9
cmp cx, 2
je 0x435cc5
cmp cx, 3
jne 0x435cbc
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x50]
jmp 0x435a50
mov eax, ebp
mov ecx, esi
jmp 0x435a50
mov ecx, dword [ebx + 0x10]
test ecx, ecx
jne 0x4367f2
lea eax, [ebx + 0x20]
mov dword [esp], eax
call fcn.00404fc0
mov eax, dword [esp + 4]
test eax, eax
jne 0x435d8d
mov ecx, dword [esp + 0x84]
mov edx, dword [ecx + 4]
cmp dword [ecx], edx
jb 0x435d02
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x44]
jmp 0x435a50
mov eax, dword [ecx + 0x14]
nop
mov edx, dword [esp + 0x4c]
mov ebx, dword [esp + 0xc0]
mov edx, dword [ebx + edx + 4]
nop
movzx ebp, word [ecx + 0xc]
imul ebp, dword [ecx + 0x18]
add ebp, dword [ecx + 8]
mov dword [esp], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], edx
call fcn.0040f580
mov eax, dword [esp + 0x84]
mov ecx, dword [eax + 0x18]
inc ecx
mov dword [eax + 0x18], ecx
cmp dword [eax + 4], ecx
jne 0x435d4b
mov dword [eax + 0x18], 0
inc dword [eax]
mov eax, dword [esp + 0xc0]
mov dword [esp], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call fcn.00435420
mov eax, dword [esp + 0x9c]
xor ecx, ecx
mov edx, dword [esp + 0x50]
jmp 0x435ab9
mov dword [esp + 0x6c], eax
lea edi, [esp + 0xa0]
xor eax, eax
call fcn.0044d189
lea ecx, [0x44b1e0]
mov dword [esp + 0xa0], ecx
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0xa4], ecx
mov edx, dword [esp + 0xc8]
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], edx
mov ebx, dword [esp + 0x74]
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], edx
mov dword [esp + 0xb8], edx
mov edx, dword [esp + 0x4c]
mov ecx, dword [ecx + edx + 4]
mov edx, dword [esp + 0x84]
mov dword [esp], edx
mov edx, dword [esp + 0x6c]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 2
call fcn.00404310
mov eax, dword [esp + 0x9c]
xor ecx, ecx
mov edx, dword [esp + 0x50]
jmp 0x435ab9
test ebp, ebp
jne 0x436736
mov ebp, dword fs:[0x14]
mov ebp, dword [ebp]
mov esi, dword [ebp + 0xb4]
test esi, esi
jne 0x4367da
mov dword [esp + 0x78], ebp
lea esi, [ebp + 0xb4]
mov dword [esp + 0x98], esi
mov eax, dword [esp + 0x74]
mov edi, esi
xor esi, esi
mov dword [esp + 0x50], esi
mov esi, edi
jmp 0x435e84
inc ebx
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x50], ebx
mov ebx, dword [esp + 0xc4]
mov ebx, dword [esp + 0x50]
cmp ebx, ecx
jge 0x436183
movzx ebp, word [eax + ebx*2]
cmp ebp, ecx
jae 0x4367d3
lea ebp, [ebp + ebp*2]
shl ebp, 3
mov dword [esp + 0x4c], ebp
movzx ebp, word [edx + ebp + 8]
test bp, bp
je 0x435e74
mov dword [esp + 0x70], esi
mov eax, dword [esp + 0x4c]
mov ecx, dword [edx + eax]
mov dword [esp + 0x80], ecx
call fcn.00429f90
mov eax, dword [esp]
test byte [eax], al
mov ecx, dword [esp + 0x24]
test ecx, ecx
setne dl
mov ebx, dword [esp + 0x20]
test ebx, ebx
xchg ebp, ebx
setne bl
xchg ebp, ebx
mov esi, dword [0x8a6100]
or edx, ebp
test esi, esi
jne 0x43616d
mov ebp, dword [esp + 0x78]
mov dword [eax], ebp
mov dword [esp + 0x60], eax
mov byte [eax + 4], 1
mov esi, dword [0x8a6100]
mov edi, ebx
mov ebx, dword [esp + 0x4c]
mov ecx, dword [esp + 0xc0]
mov ebp, dword [ecx + ebx + 4]
test esi, esi
jne 0x436154
mov dword [eax + 0x10], ebp
mov dword [eax + 0x1c], 0
mov dword [eax + 0x20], 0
test dl, dl
je 0x435f43
mov dword [eax + 0x1c], 0xffffffff
mov dword [eax + 0x20], 0xffffffff
mov edx, dword [0x8a6100]
test edx, edx
jne 0x436134
mov edx, dword [esp + 0x80]
mov dword [eax + 0x34], edx
mov ebp, dword [esp + 0x70]
test byte [ebp], al
mov esi, dword [0x8a6100]
test esi, esi
jne 0x436124
mov dword [ebp], eax
movzx ebx, word [ecx + ebx + 8]
cmp bx, 1
jne 0x43605b
test byte [edx], al
nop
mov ebx, dword [0x8a6100]
test ebx, ebx
jne 0x436042
mov dword [eax + 8], 0
lea ebx, [edx + 0x24]
mov ebp, dword [edx + 0x24]
test ebp, ebp
je 0x436001
mov esi, dword [0x8a6100]
test esi, esi
jne 0x435fdc
mov dword [eax + 0xc], ebp
mov dword [ebp + 8], eax
mov dword [edx + 0x24], eax
lea esi, [eax + 0x2c]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0xc8]
mov edx, dword [esp + 0xc0]
mov ebx, dword [esp + 0x50]
mov edi, dword [esp + 0x98]
jmp 0x435e74
lea edx, [eax + 0xc]
mov esi, edi
mov edi, edx
mov eax, ebp
call fcn.0044d090
lea edi, [eax + 8]
mov eax, dword [esp + 0x60]
call fcn.0044d090
mov edi, ebx
call fcn.0044d090
mov edi, esi
jmp 0x435fb7
mov ebp, dword [0x8a6100]
test ebp, ebp
jne 0x43601a
mov dword [eax + 0xc], 0
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
jmp 0x435fb7
lea ebp, [eax + 0xc]
mov esi, edi
mov edi, ebp
xor eax, eax
call fcn.0044d090
lea edi, [edx + 0x20]
mov eax, dword [esp + 0x60]
call fcn.0044d090
mov edi, ebx
call fcn.0044d090
mov edi, esi
jmp 0x435fb7
lea ebx, [eax + 8]
mov ebp, edi
mov edi, ebx
mov esi, eax
xor eax, eax
call fcn.0044d090
mov eax, esi
mov edi, ebp
jmp 0x435f9a
cmp bx, 2
jne 0x435fb7
test byte [edx], al
nop
mov ebx, dword [0x8a6100]
test ebx, ebx
jne 0x43610b
mov dword [eax + 8], 0
lea ebx, [edx + 0x2c]
mov ebp, dword [edx + 0x2c]
test ebp, ebp
je 0x4360c7
mov esi, dword [0x8a6100]
test esi, esi
jne 0x43609f
mov dword [eax + 0xc], ebp
mov dword [ebp + 8], eax
mov dword [edx + 0x2c], eax
jmp 0x435fb7
lea edx, [eax + 0xc]
mov esi, edi
mov edi, edx
mov eax, ebp
call fcn.0044d090
lea edi, [eax + 8]
mov eax, dword [esp + 0x60]
call fcn.0044d090
mov edi, ebx
call fcn.0044d090
mov edi, esi
jmp 0x435fb7
mov ebp, dword [0x8a6100]
test ebp, ebp
jne 0x4360e3
mov dword [eax + 0xc], 0
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], eax
jmp 0x435fb7
lea ebp, [eax + 0xc]
mov esi, edi
mov edi, ebp
xor eax, eax
call fcn.0044d090
lea edi, [edx + 0x28]
mov eax, dword [esp + 0x60]
call fcn.0044d090
mov edi, ebx
call fcn.0044d090
mov edi, esi
jmp 0x435fb7
lea ebx, [eax + 8]
mov ebp, edi
mov edi, ebx
mov esi, eax
xor eax, eax
call fcn.0044d090
mov eax, esi
mov edi, ebp
jmp 0x43607d
mov esi, edi
mov edi, ebp
call fcn.0044d090
mov edi, esi
jmp 0x435f73
lea ebp, [eax + 0x34]
mov edi, ebp
mov esi, eax
mov eax, dword [esp + 0x80]
call fcn.0044d090
mov edx, eax
mov edi, dword [esp + 0x20]
mov eax, esi
jmp 0x435f5b
lea esi, [eax + 0x10]
mov edi, esi
mov eax, ebp
call fcn.0044d090
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x20]
jmp 0x435f23
mov edi, eax
mov eax, dword [esp + 0x78]
call fcn.0044d090
mov eax, edi
mov ebp, dword [esp + 0x78]
jmp 0x435ef9
test byte [ebp], al
mov ebx, dword [0x8a6100]
lea esi, [ebp + 0x44]
mov dword [esp + 0x94], esi
test ebx, ebx
jne 0x436728
mov dword [ebp + 0x44], 0
lea eax, [0x69c568]
mov dword [esp], eax
mov dword [esp + 4], 0
mov word [esp + 8], 0x1809
mov dword [esp + 0xc], 1
call fcn.00429df0
mov eax, dword [esp + 0xc0]
mov dword [esp], eax
mov ecx, dword [esp + 0xc8]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x74]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
call fcn.00435390
mov eax, dword [esp + 0x78]
mov dword [eax + 0xcc], 0
mov ecx, dword [eax + 0x44]
mov edx, dword [0x8a6100]
test edx, edx
jne 0x436711
mov dword [eax + 0x44], 0
mov edx, dword [eax + 0xb4]
mov ebx, edx
jmp 0x43622b
mov edx, dword [edx + 0x2c]
test edx, edx
je 0x436267
mov byte [edx + 4], 0
mov ebp, dword [0x8a6100]
test ebp, ebp
jne 0x43624d
mov dword [edx + 0x10], 0
mov dword [edx + 0x34], 0
jmp 0x436228
lea edi, [edx + 0x10]
mov ebp, eax
xor eax, eax
call fcn.0044d090
lea edi, [edx + 0x34]
xor eax, eax
call fcn.0044d090
mov eax, ebp
jmp 0x436228
mov edx, dword [0x8a6100]
test edx, edx
jne 0x4366fe
mov dword [eax + 0xb4], 0
mov dword [esp + 0x90], ecx
mov edx, dword [esp + 0x74]
mov ebp, dword [esp + 0xc8]
mov esi, dword [esp + 0xc0]
xor eax, eax
xor edi, edi
mov eax, 0xffffffff
mov dword [esp + 0x44], eax
xor eax, eax
jmp 0x4362b9
inc eax
mov edx, dword [esp + 0x74]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x90]
mov dword [esp + 0x7c], edi
cmp eax, ebp
jge 0x436698
movzx ecx, word [edx + eax*2]
cmp ecx, ebp
jae 0x4367cc
mov dword [esp + 0x50], ecx
lea ecx, [ecx + ecx*2]
lea edx, [esi + ecx*8]
mov dword [esp + 0x9c], edx
shl ecx, 3
movzx edx, word [esi + ecx + 8]
test dx, dx
jne 0x4362f5
mov ecx, dword [esp + 0x44]
jmp 0x4362a9
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x64], ebx
mov edx, dword [ebx + 0x20]
mov dword [esp + 0x48], edx
test edx, edx
xchg ebp, ebx
sete bl
xchg ebp, ebx
mov ebx, dword [ebx + 0x1c]
test ebx, ebx
seta cl
test edx, edx
setg dl
and ecx, ebp
or edx, ecx
test dl, dl
je 0x43668f
mov ecx, dword [esp + 0x4c]
mov dword [esi + ecx + 0x10], ebx
mov edx, dword [esp + 0x48]
mov dword [esi + ecx + 0x14], edx
mov dword [esp + 0x4c], eax
mov edx, dword [esp + 0x64]
mov ebx, dword [esp + 0x90]
cmp edx, ebx
jne 0x4363ad
mov ecx, dword [esp + 0x9c]
mov ebp, dword [esp + 0x50]
mov dword [esp + 0x44], ebp
mov dword [esp + 0x7c], ecx
mov ebx, dword [edx + 0x2c]
mov dword [esp + 0x68], ebx
mov esi, dword [0x8a6100]
test esi, esi
jne 0x43639f
mov dword [edx + 0x2c], 0
mov dword [esp], edx
call fcn.0042a2b0
mov eax, dword [esp + 0x4c]
mov ebp, dword [esp + 0xc8]
mov esi, dword [esp + 0xc0]
mov ebx, dword [esp + 0x68]
mov edi, dword [esp + 0x7c]
mov ecx, dword [esp + 0x44]
jmp 0x4362a9
lea esi, [edx + 0x2c]
mov edi, esi
xor eax, eax
call fcn.0044d090
jmp 0x436374
mov ebp, dword [esi + ecx]
movzx ecx, word [esi + ecx + 8]
cmp cx, 2
jne 0x43652e
test byte [ebp], al
nop
mov ecx, dword [edx + 0xc]
mov ebx, dword [edx + 8]
lea esi, [edx + 8]
test ecx, ecx
je 0x436497
mov dword [esp + 0x98], esi
lea esi, [edx + 0xc]
test ebx, ebx
je 0x43644e
mov ebp, dword [0x8a6100]
test ebp, ebp
jne 0x436419
mov dword [ecx + 8], ebx
mov dword [ebx + 0xc], ecx
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
mov ebx, dword [esp + 0x90]
mov esi, dword [esp + 0xc0]
mov ecx, edi
mov ebp, dword [esp + 0x44]
jmp 0x436354
lea ebp, [ecx + 8]
mov edi, ebp
mov eax, ebx
call fcn.0044d090
lea edi, [eax + 0xc]
mov eax, ecx
call fcn.0044d090
mov edi, dword [esp + 0x98]
xor eax, eax
call fcn.0044d090
mov edi, esi
call fcn.0044d090
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x7c]
jmp 0x436400
mov ebx, dword [0x8a6100]
test ebx, ebx
jne 0x43646b
mov dword [ecx + 8], 0
mov dword [ebp + 0x2c], ecx
mov dword [edx + 0xc], 0
jmp 0x436400
lea ebx, [ecx + 8]
mov edi, ebx
xor eax, eax
call fcn.0044d090
lea edi, [ebp + 0x2c]
mov eax, ecx
call fcn.0044d090
mov edi, esi
xor eax, eax
call fcn.0044d090
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x7c]
jmp 0x436400
test ebx, ebx
je 0x4364e7
mov ecx, dword [0x8a6100]
test ecx, ecx
jne 0x4364bb
mov dword [ebx + 0xc], 0
mov dword [ebp + 0x28], ebx
mov dword [edx + 8], 0
jmp 0x436400
lea ecx, [ebx + 0xc]
mov edi, ecx
xor eax, eax
call fcn.0044d090
lea edi, [ebp + 0x28]
mov eax, ebx
call fcn.0044d090
mov edi, esi
xor eax, eax
call fcn.0044d090
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x7c]
jmp 0x436400
cmp dword [ebp + 0x28], edx
jne 0x436400
mov ecx, dword [0x8a6100]
test ecx, ecx
jne 0x43650d
mov dword [ebp + 0x28], 0
mov dword [ebp + 0x2c], 0
jmp 0x436400
lea ecx, [ebp + 0x28]
mov ebx, edi
mov edi, ecx
mov esi, eax
xor eax, eax
call fcn.0044d090
lea edi, [ebp + 0x2c]
call fcn.0044d090
mov eax, esi
mov edi, ebx
jmp 0x436400
test byte [ebp], al
nop
mov ecx, dword [edx + 0xc]
mov ebx, dword [edx + 8]
lea esi, [edx + 8]
test ecx, ecx
je 0x4365f8
mov dword [esp + 0x98], esi
lea esi, [edx + 0xc]
test ebx, ebx
je 0x4365ac
mov ebp, dword [0x8a6100]
test ebp, ebp
jne 0x436574
mov dword [ecx + 8], ebx
mov dword [ebx + 0xc], ecx
mov dword [edx + 8], 0
mov dword [edx + 0xc], 0
jmp 0x436400
lea ebp, [ecx + 8]
mov edi, ebp
mov eax, ebx
call fcn.0044d090
lea edi, [eax + 0xc]
mov eax, ecx
call fcn.0044d090
mov edi, dword [esp + 0x98]
xor eax, eax
call fcn.0044d090
mov edi, esi
call fcn.0044d090
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x7c]
jmp 0x436400
mov ebx, dword [0x8a6100]
test ebx, ebx
jne 0x4365cc
mov dword [ecx + 8], 0
mov dword [ebp + 0x24], ecx
mov dword [edx + 0xc], 0
jmp 0x436400
lea ebx, [ecx + 8]
mov edi, ebx
xor eax, eax
call fcn.0044d090
lea edi, [ebp + 0x24]
mov eax, ecx
call fcn.0044d090
mov edi, esi
xor eax, eax
call fcn.0044d090
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x7c]
jmp 0x436400
test ebx, ebx
je 0x436648
mov ecx, dword [0x8a6100]
test ecx, ecx
jne 0x43661c
mov dword [ebx + 0xc], 0
mov dword [ebp + 0x20], ebx
mov dword [edx + 8], 0
jmp 0x436400
lea ecx, [ebx + 0xc]
mov edi, ecx
xor eax, eax
call fcn.0044d090
lea edi, [ebp + 0x20]
mov eax, ebx
call fcn.0044d090
mov edi, esi
xor eax, eax
call fcn.0044d090
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x7c]
jmp 0x436400
cmp dword [ebp + 0x20], edx
jne 0x436400
mov ecx, dword [0x8a6100]
test ecx, ecx
jne 0x43666e
mov dword [ebp + 0x20], 0
mov dword [ebp + 0x24], 0
jmp 0x436400
lea ecx, [ebp + 0x20]
mov ebx, edi
mov edi, ecx
mov esi, eax
xor eax, eax
call fcn.0044d090
lea edi, [ebp + 0x24]
call fcn.0044d090
mov eax, esi
mov edi, ebx
jmp 0x436400
mov ecx, dword [esp + 0x4c]
jmp 0x436336
test edi, edi
jne 0x4366bc
mov ecx, dword [esp + 0xc8]
mov edx, dword [esp + 0xc0]
mov ebx, dword [esp + 0xc4]
xor eax, eax
xor ebp, ebp
xor esi, esi
jmp 0x4359b9
movzx eax, word [edi + 8]
mov word [esp + 0x1e], ax
cmp ax, 1
mov dword [esp], esi
mov dword [esp + 4], ebp
mov dword [esp + 8], ebp
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
call fcn.00435420
movzx eax, word [esp + 0x1e]
cmp ax, 1
sete cl
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + 0x44]
jmp 0x435ab9
mov edi, dword [esp + 0x98]
xor eax, eax
call fcn.0044d090
jmp 0x43627f
mov edi, dword [esp + 0x94]
mov edx, eax
xor eax, eax
call fcn.0044d090
mov eax, edx
jmp 0x43621e
mov edi, esi
xor eax, eax
call fcn.0044d090
jmp 0x4361a5
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov eax, dword [esp + 0x74]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
call fcn.00435420
mov eax, dword [esp + 0x7c]
xor ecx, ecx
mov edx, dword [esp + 0x44]
jmp 0x435ab9
call fcn.0044cc80
mov eax, dword [esp + 4]
mov ecx, dword [esp]
mov edx, dword [esp + 0xc0]
mov ebx, dword [esp + 0xc8]
xor ebp, ebp
jmp 0x43679f
lea esi, [ebp + ebp*2]
mov edi, esi
shl esi, 3
mov dword [edx + esi + 0x10], 0xffffffff
lea esi, [edx + edi*8]
mov dword [esi + 0x14], 0xffffffff
inc ebp
cmp ebp, ebx
jge 0x4367aa
jb 0x436783
jmp 0x43688e
mov ebx, dword [esp + 0xc4]
mov ebp, dword [esp + 0xc8]
mov edx, ecx
mov esi, eax
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0xc0]
jmp 0x4356c8
call fcn.00427150
ud2
call fcn.00427150
ud2
lea eax, [0x6881e3]
mov dword [esp], eax
mov dword [esp + 4], 0x11
call fcn.00428450
ud2
mov dword [esp], edx
mov eax, dword [esp + 0xc8]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x74]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
call fcn.00435420
lea eax, [0x64e900]
mov dword [esp], eax
lea eax, [0x6e2788]
mov dword [esp + 4], eax
call fcn.00427f10
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427150
ud2
call fcn.00427250
ud2
call fcn.00427250
ud2
call fcn.0044b940
jmp fcn.00435590