Function at 0x40d200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4beeb6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x278
push ebx
push ebp
push esi
mov esi, dword [esp + 0x294]
mov ebp, ecx
mov ecx, dword [ebp + 0x134]
mov edx, dword [ecx]
push edi
lea eax, [ebp + 0x198]
push esi
push eax
mov dword [esp + 0x1c], ebp
call dword [edx + 0x30]
test al, al
je 0x40e043
mov eax, dword [ebp + 0x190]
lea esi, [ebp + 0x178]
mov edi, 0x10
push ecx
cmp eax, edi
mov edx, esp
lea eax, [esi + 4]
jb 0x40d266
mov ecx, dword [eax]
jmp 0x40d268
mov ecx, eax
mov ebx, dword [esi + 0x14]
add ebx, ecx
mov dword [edx], ebx
cmp dword [esi + 0x18], edi
push ecx
mov ecx, esp
jb 0x40d279
mov eax, dword [eax]
mov dword [ecx], eax
lea eax, [esp + 0x98]
push eax
mov ecx, esi
call fcn.00405120
mov eax, 0x4e95dc
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d294
sub eax, edx
push eax
push 0x4e95dc
mov ecx, esi
call fcn.00401810
mov eax, 0x4e97f0
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d2b2
sub eax, edi
push eax
push 0x4e97f0
mov ecx, esi
call fcn.00401810
lea ecx, [esp + 0x50]
push ecx
lea ecx, [ebp + 4]
call fcn.0040c670
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x58]
push edx
lea ecx, [esp + 0x40]
mov dword [esp + 0x29c], ebx
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.00401a00
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
mov byte [esp + 0x29c], 1
call fcn.00401720
cmp dword [esp + 0x4c], 0x10
jb 0x40d328
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00442830
add esp, 4
cmp dword [esp + 0x68], 0x10
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
mov dword [esp + 0x290], 0xffffffff
jb 0x40d357
mov edx, dword [esp + 0x54]
push edx
call fcn.00442830
add esp, 4
mov eax, 0x4e97e0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d360
sub eax, edx
push eax
push 0x4e97e0
mov ecx, esi
call fcn.00401810
mov eax, 0x4e97bc
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d380
sub eax, edi
push eax
push 0x4e97bc
mov ecx, esi
call fcn.00401810
mov eax, 0x4e9798
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d3a0
sub eax, edi
push eax
push 0x4e9798
mov ecx, esi
call fcn.00401810
mov eax, 0x4e9794
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d3c0
sub eax, edi
push eax
mov eax, dword [ebp + 0x1ac]
lea ecx, [ebp + 0x198]
push 0x4e9794
push eax
push ebx
call fcn.004011e0
test eax, eax
je 0x40d4b6
mov eax, 0x4e9774
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d3f2
sub eax, edi
push eax
push 0x4e9774
mov ecx, esi
call fcn.00401810
lea eax, [ebp + 0x198]
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.00448950
push eax
lea edx, [esp + 0x78]
push edx
mov dword [esp + 0x2a0], 2
call fcn.00460e60
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x29c], 3
call fcn.00401720
cmp dword [esp + 0x84], 0x10
jb 0x40d45c
mov eax, dword [esp + 0x70]
push eax
call fcn.00442830
add esp, 4
cmp dword [esp + 0x68], 0x10
mov dword [esp + 0x84], 0xf
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
mov dword [esp + 0x290], 0xffffffff
jb 0x40d491
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00442830
add esp, 4
mov eax, 0x4e975c
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d4a0
sub eax, edx
push eax
push 0x4e975c
mov ecx, esi
call fcn.00401810
sub esp, 0x1c
mov edi, esp
mov eax, 0x4f2fc0
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0xac], esp
mov byte [edi + 4], bl
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d4d7
sub eax, ebp
push eax
push 0x4f2fc0
mov ecx, edi
call fcn.00401ab0
lea ecx, [esp + 0x29c]
mov dword [esp + 0x2ac], 4
call fcn.00448120
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
push ebx
push ebx
sub esp, 0x1c
mov edi, esp
mov eax, 0x4f2fc0
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov dword [esp + 0xd0], esp
mov byte [edi + 4], bl
lea ebp, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d530
sub eax, ebp
push eax
push 0x4f2fc0
mov ecx, edi
call fcn.00401ab0
lea ecx, [esp + 0x264]
mov dword [esp + 0x2d8], 0xffffffff
call fcn.00455120
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x134]
mov edx, dword [ecx]
lea eax, [esp + 0x21c]
push eax
mov dword [esp + 0x294], 5
call dword [edx + 0x34]
test al, al
mov ebp, 0x10
je 0x40df18
lea esp, [esp]
mov eax, 0x4e9754
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d598
sub eax, edx
push eax
push 0x4e9754
mov ecx, esi
call fcn.00401810
mov eax, 0x4e974c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d5b6
sub eax, edx
push eax
push 0x4e974c
mov ecx, esi
call fcn.00401810
cmp dword [esp + 0x254], 2
jne 0x40d7c9
mov eax, 0x4e9740
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d5e2
sub eax, edi
push eax
push 0x4e9740
mov ecx, esi
call fcn.00401810
lea ecx, [esp + 0x94]
push ecx
lea ecx, [esp + 0x220]
call fcn.0040c770
mov edi, eax
mov eax, dword [esp + 0x14]
push 0x4e9330
add eax, 0x198
push eax
lea edx, [esp + 0x1ec]
push edx
mov byte [esp + 0x29c], 6
call fcn.00401bb0
push edi
push eax
lea eax, [esp + 0xe0]
push eax
mov byte [esp + 0x2a8], 7
call fcn.00401c60
push eax
lea ecx, [esp + 0x158]
push ecx
mov byte [esp + 0x2b0], 8
call fcn.00460e60
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x29c], 9
call fcn.00401720
cmp dword [esp + 0x154], ebp
jb 0x40d68e
mov edx, dword [esp + 0x140]
push edx
call fcn.00442830
add esp, 4
cmp dword [esp + 0xe4], ebp
mov edi, 0xf
mov dword [esp + 0x154], edi
mov dword [esp + 0x150], ebx
mov byte [esp + 0x140], bl
jb 0x40d6c1
mov eax, dword [esp + 0xd0]
push eax
call fcn.00442830
add esp, 4
cmp dword [esp + 0x1fc], ebp
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
jb 0x40d6ef
mov ecx, dword [esp + 0x1e8]
push ecx
call fcn.00442830
add esp, 4
cmp dword [esp + 0xac], ebp
mov dword [esp + 0x1fc], edi
mov dword [esp + 0x1f8], ebx
mov byte [esp + 0x1e8], bl
mov byte [esp + 0x290], 5
jb 0x40d725
mov edx, dword [esp + 0x98]
push edx
call fcn.00442830
add esp, 4
mov eax, 0x4e973c
mov dword [esp + 0xac], edi
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x98], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d742
sub eax, edx
push eax
push 0x4e973c
mov ecx, esi
call fcn.00401810
cmp dword [0x4e986c], ebx
je 0x40d7ab
mov eax, 0x4e9718
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d768
sub eax, edx
push eax
push 0x4e9718
mov ecx, esi
call fcn.00401810
push 0xffffffffffffffff
push ebx
push 0x4e9858
mov ecx, esi
call fcn.00401720
mov eax, 0x4e9714
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d795
sub eax, edi
push eax
push 0x4e9714
mov ecx, esi
call fcn.00401810
mov eax, 0x4e970c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d7b3
sub eax, edx
push eax
push 0x4e970c
mov ecx, esi
call fcn.00401810
mov eax, 0x4e9704
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d7d1
sub eax, edx
push eax
push 0x4e9704
mov ecx, esi
call fcn.00401810
mov eax, 0x4e974c
lea edi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d7f0
sub eax, edi
push eax
push 0x4e974c
mov ecx, esi
call fcn.00401810
mov eax, 0x4e9740
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d810
sub eax, edi
push eax
push 0x4e9740
mov ecx, esi
call fcn.00401810
lea eax, [esp + 0x174]
push eax
lea ecx, [esp + 0x220]
call fcn.0040c770
mov edi, eax
mov eax, dword [esp + 0x14]
push 0x4e9330
add eax, 0x198
push eax
lea ecx, [esp + 0x1b4]
push ecx
mov byte [esp + 0x29c], 0xa
call fcn.00401bb0
push edi
push eax
lea edx, [esp + 0x134]
push edx
mov byte [esp + 0x2a8], 0xb
call fcn.00401c60
push eax
lea eax, [esp + 0x120]
push eax
mov byte [esp + 0x2b0], 0xc
call fcn.00460e60
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x29c], 0xd
call fcn.00401720
cmp dword [esp + 0x11c], ebp
jb 0x40d8bc
mov ecx, dword [esp + 0x108]
push ecx
call fcn.00442830
add esp, 4
cmp dword [esp + 0x138], ebp
mov edi, 0xf
mov dword [esp + 0x11c], edi
mov dword [esp + 0x118], ebx
mov byte [esp + 0x108], bl
jb 0x40d8ef
mov edx, dword [esp + 0x124]
push edx
call fcn.00442830
add esp, 4
cmp dword [esp + 0x1c4], ebp
mov dword [esp + 0x138], edi
mov dword [esp + 0x134], ebx
mov byte [esp + 0x124], bl
jb 0x40d91d
mov eax, dword [esp + 0x1b0]
push eax
call fcn.00442830
add esp, 4
cmp dword [esp + 0x18c], ebp
mov dword [esp + 0x1c4], edi
mov dword [esp + 0x1c0], ebx
mov byte [esp + 0x1b0], bl
mov byte [esp + 0x290], 5
jb 0x40d953
mov ecx, dword [esp + 0x178]
push ecx
call fcn.00442830
add esp, 4
mov eax, 0x4e973c
mov dword [esp + 0x18c], edi
mov dword [esp + 0x188], ebx
mov byte [esp + 0x178], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d970
sub eax, edx
push eax
push 0x4e973c
mov ecx, esi
call fcn.00401810
cmp dword [esp + 0x254], 2
jne 0x40da7d
mov eax, 0x4e9700
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40d9a0
sub eax, edx
push eax
push 0x4e9700
mov ecx, esi
call fcn.00401810
lea edx, [esp + 0xe8]
push edx
lea ecx, [esp + 0x220]
call fcn.0040c770
push eax
lea eax, [esp + 0xb4]
push eax
mov byte [esp + 0x298], 0xe
call fcn.00460e60
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x29c], 0xf
call fcn.00401720
cmp dword [esp + 0xc8], ebp
jb 0x40da0f
mov ecx, dword [esp + 0xb4]
push ecx
call fcn.00442830
add esp, 4
cmp dword [esp + 0x100], ebp
mov dword [esp + 0xc8], edi
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
mov byte [esp + 0x290], 5
jb 0x40da45
mov edx, dword [esp + 0xec]
push edx
call fcn.00442830
add esp, 4
mov eax, 0x4e96f8
mov dword [esp + 0x100], edi
mov dword [esp + 0xfc], ebx
mov byte [esp + 0xec], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40da62
sub eax, edx
push eax
push 0x4e96f8
mov ecx, esi
call fcn.00401810
jmp 0x40db21
lea eax, [esp + 0x190]
push eax
lea ecx, [esp + 0x220]
call fcn.0040c770
push eax
lea ecx, [esp + 0x15c]
push ecx
mov byte [esp + 0x298], 0x10
call fcn.00460e60
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x29c], 0x11
call fcn.00401720
cmp dword [esp + 0x170], ebp
jb 0x40dad6
mov edx, dword [esp + 0x15c]
push edx
call fcn.00442830
add esp, 4
cmp dword [esp + 0x1a8], ebp
mov dword [esp + 0x170], edi
mov dword [esp + 0x16c], ebx
mov byte [esp + 0x15c], bl
mov byte [esp + 0x290], 5
jb 0x40db0c
mov eax, dword [esp + 0x194]
push eax
call fcn.00442830
add esp, 4
mov dword [esp + 0x1a8], edi
mov dword [esp + 0x1a4], ebx
mov byte [esp + 0x194], bl
mov eax, 0x4e96f0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40db30
sub eax, edx
push eax
push 0x4e96f0
mov ecx, esi
call fcn.00401810
mov eax, 0x4e9704
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40db50
sub eax, edi
push eax
push 0x4e9704
mov ecx, esi
call fcn.00401810
mov eax, 0x4e96d0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40db70
sub eax, edx
push eax
push 0x4e96d0
mov ecx, esi
call fcn.00401810
cmp dword [esp + 0x254], 1
jne 0x40dbf5
mov ecx, dword [esp + 0x258]
push ecx
lea edx, [esp + 0x1cc]
push edx
call fcn.0044c510
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x29c], 0x12
call fcn.00401720
cmp dword [esp + 0x1e0], ebp
mov byte [esp + 0x290], 5
jb 0x40dbdc
mov eax, dword [esp + 0x1cc]
push eax
call fcn.00442830
add esp, 4
mov dword [esp + 0x1e0], 0xf
mov dword [esp + 0x1dc], ebx
mov byte [esp + 0x1cc], bl
mov eax, 0x4e9704
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dc00
sub eax, edx
push eax
push 0x4e9704
mov ecx, esi
call fcn.00401810
mov eax, dword [esp + 0x25c]
cmp ax, bx
je 0x40ddf5
mov ecx, dword [esp + 0x260]
lea edx, [esp + 0x88]
mov dword [esp + 0x88], eax
push edx
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x94], ecx
call fcn.0044c5d0
add esp, 8
push 1
push 1
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x24]
mov byte [esp + 0x29c], 0x13
mov byte [esp + 0x1c], 0x20
call fcn.00405a90
mov ebp, eax
mov eax, 0x4e96d0
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dc80
sub eax, edi
push eax
push 0x4e96d0
mov ecx, esi
call fcn.00401810
push ebp
push ebx
lea edx, [esp + 0x20]
mov edi, 0xf
push edx
lea ecx, [esp + 0x40]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.00401a00
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x3c]
push eax
mov ecx, esi
mov byte [esp + 0x29c], 0x14
call fcn.00401720
cmp dword [esp + 0x4c], 0x10
mov byte [esp + 0x290], 0x13
jb 0x40dcea
mov ecx, dword [esp + 0x38]
push ecx
call fcn.00442830
add esp, 4
mov eax, 0x4e9704
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dd00
sub eax, edx
push eax
push 0x4e9704
mov ecx, esi
call fcn.00401810
mov eax, 0x4e96b4
lea edi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dd20
sub eax, edi
push eax
push 0x4e96b4
mov ecx, esi
call fcn.00401810
push 6
push ebp
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
call fcn.00401a00
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x74]
push eax
mov ecx, esi
mov byte [esp + 0x29c], 0x15
call fcn.00401720
cmp dword [esp + 0x84], 0x10
mov byte [esp + 0x290], 0x13
jb 0x40dd93
mov ecx, dword [esp + 0x70]
push ecx
call fcn.00442830
add esp, 4
mov edi, 0xf
mov eax, 0x4e9704
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40ddb2
sub eax, edx
push eax
push 0x4e9704
mov ecx, esi
call fcn.00401810
cmp dword [esp + 0x30], 0x10
mov byte [esp + 0x290], 5
jb 0x40dde4
mov edx, dword [esp + 0x1c]
push edx
call fcn.00442830
add esp, 4
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
mov ebp, 0x10
cmp dword [esp + 0x254], 3
jne 0x40dedb
mov eax, 0x4e96a0
lea edx, [eax + 1]
jmp 0x40de10
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40de10
sub eax, edx
push eax
push 0x4e96a0
mov ecx, esi
call fcn.00401810
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x220]
call fcn.0040c7a0
push eax
lea ecx, [esp + 0x204]
push ecx
mov byte [esp + 0x298], 0x16
call fcn.00460e60
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x29c], 0x17
call fcn.00401720
cmp dword [esp + 0x218], ebp
jb 0x40de7c
mov edx, dword [esp + 0x204]
push edx
call fcn.00442830
add esp, 4
cmp dword [esp + 0x68], ebp
mov edi, 0xf
mov dword [esp + 0x218], edi
mov dword [esp + 0x214], ebx
mov byte [esp + 0x204], bl
mov byte [esp + 0x290], 5
jb 0x40deb1
mov eax, dword [esp + 0x54]
push eax
call fcn.00442830
add esp, 4
mov eax, 0x4e9704
mov dword [esp + 0x68], edi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dec5
sub eax, edx
push eax
push 0x4e9704
mov ecx, esi
call fcn.00401810
mov eax, 0x4e9698
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dee3
sub eax, edx
push eax
push 0x4e9698
mov ecx, esi
call fcn.00401810
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x134]
mov edx, dword [ecx]
lea eax, [esp + 0x21c]
push eax
call dword [edx + 0x34]
test al, al
jne 0x40d590
mov edi, dword [esp + 0x14]
mov eax, 0x4e966c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40df24
sub eax, edx
push eax
push 0x4e966c
mov ecx, esi
call fcn.00401810
mov eax, 0x4e95b8
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40df52
sub eax, esi
push eax
push 0x4e95b8
lea ecx, [esp + 0x20]
call fcn.00401ab0
mov eax, dword [edi + 0x18c]
push eax
lea ecx, [esp + 0x54]
push ecx
mov byte [esp + 0x298], 0x18
call fcn.0044c450
add esp, 8
mov ecx, dword [edi + 0x13c]
push eax
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x298], 0x19
call fcn.004696f0
cmp dword [esp + 0x68], ebp
jb 0x40dfb2
mov eax, dword [esp + 0x54]
push eax
call fcn.00442830
add esp, 4
cmp dword [esp + 0x30], ebp
mov esi, 0xf
mov dword [esp + 0x68], esi
mov dword [esp + 0x64], ebx
mov byte [esp + 0x54], bl
mov byte [esp + 0x290], 5
jb 0x40dfde
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00442830
add esp, 4
mov eax, 0x4e9658
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40dff2
sub eax, edx
push eax
push 0x4e9658
lea ecx, [esp + 0x20]
call fcn.00401ab0
mov ecx, dword [edi + 0x13c]
lea edx, [esp + 0x18]
push edx
mov byte [esp + 0x294], 0x1a
call fcn.00468130
cmp dword [esp + 0x30], ebp
jb 0x40e035
mov eax, dword [esp + 0x1c]
push eax
call fcn.00442830
add esp, 4
lea ecx, [esp + 0x21c]
call fcn.0040c690
mov al, 1
mov ecx, dword [esp + 0x288]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x284
ret 4