Function at 0x408b18
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x8c
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa4]
mov edx, dword [esp + 0x94]
push ebx
mov ebx, dword [esp + 0xa4]
push edi
mov edi, dword [esp + 0xa4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], edi
mov dword [esp + 0x4c], ebx
cmp eax, 0x20
jae 0x408f39
xor ecx, ecx
mov word [esp + eax + 0x50], cx
add eax, 2
cmp eax, 0x1e
jbe 0x408b5c
push ebp
mov ebp, dword [esp + 0xa4]
xor eax, eax
test ebp, ebp
je 0x408b92
movzx eax, word [edx + ecx*2]
inc word [esp + eax*2 + 0x54]
inc ecx
cmp ecx, ebp
jb 0x408b82
xor eax, eax
push esi
push 0xf
pop esi
cmp word [esp + esi*2 + 0x58], ax
jne 0x408ba3
dec esi
cmp esi, 1
jae 0x408b96
cmp dword [ebx], esi
mov eax, esi
cmovbe eax, dword [ebx]
test esi, esi
jne 0x408bd3
mov ecx, dword [edi]
mov dword [esp + 0x10], 0x140
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
add dword [edi], 4
mov ecx, dword [edi]
mov dword [ecx], eax
add dword [edi], 4
mov dword [ebx], 1
jmp 0x408f14
xor edx, edx
inc edx
cmp esi, edx
jbe 0x408be8
xor ecx, ecx
cmp word [esp + edx*2 + 0x58], cx
jne 0x408be8
inc edx
cmp edx, esi
jb 0x408bdc
cmp eax, edx
mov ecx, edx
cmovae ecx, eax
xor ebx, ebx
mov dword [esp + 0x24], ecx
xor ecx, ecx
inc ecx
inc ebx
movzx eax, word [esp + ebx*2 + 0x58]
add ecx, ecx
sub ecx, eax
js 0x408f34
inc ebx
cmp ebx, 0xf
jbe 0x408bf9
test ecx, ecx
jle 0x408c29
cmp dword [esp + 0xa0], 0
je 0x408f34
cmp esi, 1
jne 0x408f34
xor eax, eax
push 2
mov word [esp + 0x7e], ax
pop ecx
mov ax, word [esp + ecx + 0x58]
add ax, word [esp + ecx + 0x78]
mov word [esp + ecx + 0x7a], ax
add ecx, 2
cmp ecx, 0x1e
jb 0x408c33
xor eax, eax
mov ecx, eax
test ebp, ebp
je 0x408c7e
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x3c]
movzx eax, word [edi + ecx*2]
test ax, ax
je 0x408c75
movzx eax, word [esp + eax*2 + 0x78]
mov word [ebx + eax*2], cx
movzx eax, word [edi + ecx*2]
inc word [esp + eax*2 + 0x78]
inc ecx
cmp ecx, ebp
jb 0x408c5a
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0xa0]
xor ecx, ecx
sub eax, ecx
je 0x408cc0
sub eax, 1
je 0x408ca6
mov dword [esp + 0x30], 0x429720
mov dword [esp + 0x2c], 0x429760
mov dword [esp + 0x20], ecx
jmp 0x408cd4
mov dword [esp + 0x30], 0x4296a0
mov dword [esp + 0x2c], 0x4296e0
mov dword [esp + 0x20], 0x101
jmp 0x408cd4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], 0x14
mov eax, dword [edi]
mov ebp, ecx
or dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x1c], eax
xor eax, eax
inc eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x24]
shl eax, cl
cmp dword [esp + 0xa0], 1
mov ebx, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x34], ebx
lea eax, [ebx - 1]
mov dword [esp + 0x4c], eax
jne 0x408d15
cmp ebx, 0x354
ja 0x408f2f
cmp dword [esp + 0xa0], 2
jne 0x408d2b
cmp ebx, 0x250
ja 0x408f2f
mov al, dl
sub al, byte [esp + 0x18]
mov byte [esp + 0x11], al
mov eax, dword [esp + 0x14]
movzx ebx, word [eax]
mov ecx, ebx
lea eax, [ecx + 1]
cmp eax, dword [esp + 0x20]
jae 0x408d54
xor eax, eax
mov word [esp + 0x12], bx
mov byte [esp + 0x10], al
jmp 0x408d7f
mov eax, dword [esp + 0x20]
cmp ecx, eax
jb 0x408d73
sub ecx, eax
mov eax, dword [esp + 0x2c]
mov al, byte [eax + ecx*2]
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x30]
mov ax, word [eax + ecx*2]
jmp 0x408d7a
mov byte [esp + 0x10], 0x60
xor eax, eax
mov word [esp + 0x12], ax
mov ebx, dword [esp + 0x44]
xor eax, eax
inc eax
mov dword [esp + 0x50], ebx
mov ecx, edx
sub ecx, dword [esp + 0x18]
shl eax, cl
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
shl eax, 2
mov dword [esp + 0x38], eax
mov eax, ebp
shr eax, cl
mov ecx, dword [esp + 0x1c]
add eax, ebx
lea ecx, [ecx + eax*4]
mov eax, dword [esp + 0x10]
sub ecx, dword [esp + 0x38]
mov dword [ecx], eax
sub ebx, dword [esp + 0x28]
jne 0x408db2
lea ecx, [edx - 1]
inc ebx
shl ebx, cl
jmp 0x408dc8
shr ebx, 1
test ebp, ebx
jne 0x408dc6
test ebx, ebx
je 0x408ddd
lea eax, [ebx - 1]
and ebp, eax
add ebp, ebx
mov dword [esp + 0x28], ebp
jmp 0x408de5
xor eax, eax
mov ebp, eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
mov ecx, 0xffff
add eax, 2
add word [esp + edx*2 + 0x58], cx
mov dword [esp + 0x14], eax
jne 0x408e0f
cmp edx, esi
je 0x408ee6
movzx eax, word [eax]
mov ecx, dword [esp + 0x3c]
movzx edx, word [ecx + eax*2]
mov ecx, dword [esp + 0x24]
cmp edx, ecx
jbe 0x408d2b
mov eax, dword [esp + 0x4c]
and eax, ebp
mov dword [esp + 0x38], eax
cmp eax, dword [esp + 0x48]
je 0x408d2b
mov eax, dword [esp + 0x50]
mov ebx, ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
cmovne ebx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
lea ecx, [ecx + eax*4]
mov dword [esp + 0x1c], ecx
mov ecx, edx
sub ecx, ebx
xor ebx, ebx
inc ebx
shl ebx, cl
cmp edx, esi
jae 0x408e7f
lea edi, [esp + 0x58]
mov ebp, edx
lea edi, [edi + edx*2]
movzx eax, word [edi]
sub ebx, eax
test ebx, ebx
jle 0x408e77
inc ecx
add edi, 2
inc ebp
add ebx, ebx
cmp ebp, esi
jb 0x408e63
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x34]
xor eax, eax
inc eax
shl eax, cl
add ebx, eax
mov dword [esp + 0x44], eax
cmp dword [esp + 0xa0], 1
mov dword [esp + 0x34], ebx
jne 0x408ea8
cmp ebx, 0x354
ja 0x408f2f
cmp dword [esp + 0xa0], 2
jne 0x408eba
cmp ebx, 0x250
ja 0x408f2f
mov ebx, dword [esp + 0x38]
mov eax, dword [edi]
mov dword [esp + 0x48], ebx
mov byte [eax + ebx*4], cl
mov eax, dword [edi]
mov ecx, dword [esp + 0x24]
mov byte [eax + ebx*4 + 1], cl
mov ecx, dword [edi]
mov eax, dword [esp + 0x1c]
sub eax, ecx
sar eax, 2
mov word [ecx + ebx*4 + 2], ax
jmp 0x408d2b
test ebp, ebp
je 0x408f01
mov ecx, dword [esp + 0x1c]
xor eax, eax
mov byte [esp + 0x10], 0x40
mov word [esp + 0x12], ax
mov eax, dword [esp + 0x10]
mov dword [ecx + ebp*4], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x54]
shl eax, 2
add dword [edi], eax
mov eax, dword [esp + 0x24]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [esp + 0x98]
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.004097a8
add esp, 0x8c
ret
xor eax, eax
inc eax
jmp 0x408f16
or eax, 0xffffffff
jmp 0x408f16
call fcn.00420db7
int3