Function at 0x40f200
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x468263
mov eax, dword fs:[0]
push eax
sub esp, 0x4ec
push ebx
push ebp
push esi
push edi
mov eax, dword [0x487bb0]
xor eax, esp
push eax
lea eax, [esp + 0x500]
mov dword fs:[0], eax
mov eax, dword [esp + 0x510]
xor ebx, ebx
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], ebx
mov ecx, 7
mov dword [eax + 0x18], 0xf
mov dword [eax + 0x14], ebx
mov dword [esp + 0x508], ecx
mov byte [eax + 4], bl
sub esp, 0x1c
mov eax, 3
mov dword [esp + 0x30], esp
mov esi, 4
mov dword [esp + 0x120], ecx
mov dword [esp + 0x128], ecx
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], ecx
mov ecx, esp
mov edx, 6
mov ebp, 8
push 0xffffffffffffffff
mov edi, 1
mov dword [esp + 0xec], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0xd0], eax
mov dword [esp + 0xe8], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0xf0], edx
mov dword [esp + 0xf4], edx
mov edx, 5
push ebx
lea eax, [esp + 0x58c]
mov dword [esp + 0xfc], ebp
mov dword [esp + 0x134], ebp
mov ebp, 2
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov dword [esp + 0xd4], edi
mov dword [esp + 0x104], edx
mov dword [esp + 0x108], esi
mov dword [esp + 0x148], esi
mov dword [esp + 0x150], esi
mov dword [esp + 0x154], edi
mov dword [esp + 0x130], edi
mov dword [esp + 0x13c], edx
mov dword [esp + 0x140], esi
mov dword [esp + 0xdc], edx
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], 0xb
mov dword [esp + 0xe8], esi
mov dword [esp + 0xec], ebp
mov dword [esp + 0x164], ebp
mov dword [esp + 0x168], ebp
mov dword [esp + 0x16c], edx
mov dword [esp + 0x170], ebp
mov dword [esp + 0x174], 9
mov dword [esp + 0x178], ebp
mov dword [esp + 0x180], ebp
mov dword [esp + 0x184], ebp
mov dword [esp + 0x110], edi
mov dword [esp + 0x11c], 8
mov dword [esp + 0x120], esi
mov dword [esp + 0x124], edx
mov byte [ecx + 4], bl
call fcn.00403020
push 0xa
lea ecx, [esp + 0x15c]
push ecx
lea edx, [esp + 0x3c]
push edx
call fcn.0040f130
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x538]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x530], 8
mov byte [ecx + 4], bl
call fcn.00403020
push 6
lea ecx, [esp + 0xec]
push ecx
lea edx, [esp + 0x84]
push edx
call fcn.0040f130
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x554]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x530], 9
mov byte [ecx + 4], bl
call fcn.00403020
push esi
lea ecx, [esp + 0x140]
push ecx
lea edx, [esp + 0xb4]
push edx
call fcn.0040f130
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x570]
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x530], 0xa
mov byte [ecx + 4], bl
call fcn.00403020
push 6
lea ecx, [esp + 0x124]
push ecx
lea edx, [esp + 0x6c]
push edx
call fcn.0040f130
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x5a8]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [esp + 0x530], 0xb
mov byte [ecx + 4], bl
call fcn.00403020
push 7
lea ecx, [esp + 0xd0]
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.0040f130
add esp, 0xc
mov byte [esp + 0x524], 0xc
mov dword [esp + 0x30], esp
mov ecx, esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x5e0]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00403020
push 6
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x9c]
push edx
call fcn.0040f130
add esp, 0x28
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0xd
jne 0x40f556
call fcn.004507b0
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x40f57c
call fcn.004507b0
mov edx, dword [esp + 0x24]
push esi
push edx
lea eax, [esp + 0x144]
push eax
call fcn.0040acc0
lea ecx, [esp + 0x5ac]
push ecx
push eax
lea edx, [esp + 0x4c0]
push edx
mov byte [esp + 0x520], 0xe
call fcn.0040acc0
add esp, 0x18
mov esi, eax
mov ecx, dword [esp + 0x70]
sub ecx, dword [esp + 0x6c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0xf
cmp eax, edi
ja 0x40f5de
call fcn.004507b0
mov eax, dword [esp + 0x6c]
add eax, 0x1c
push eax
lea ecx, [esp + 0x478]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0xa0]
sub ecx, dword [esp + 0x9c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x10
cmp eax, ebp
ja 0x40f62b
call fcn.004507b0
mov eax, dword [esp + 0x9c]
add eax, 0x38
push eax
lea ecx, [esp + 0x440]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x11
cmp eax, edi
ja 0x40f675
call fcn.004507b0
mov eax, dword [esp + 0x24]
add eax, 0x1c
push eax
lea ecx, [esp + 0x408]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x54]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x12
cmp eax, ebp
ja 0x40f6bc
call fcn.004507b0
mov eax, dword [esp + 0x54]
add eax, 0x38
push eax
lea ecx, [esp + 0x3d0]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x54]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x13
cmp eax, edi
ja 0x40f703
call fcn.004507b0
mov eax, dword [esp + 0x54]
add eax, 0x1c
push eax
lea ecx, [esp + 0x398]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0xa0]
sub ecx, dword [esp + 0x9c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x14
cmp eax, 3
ja 0x40f751
call fcn.004507b0
mov eax, dword [esp + 0x9c]
add eax, 0x54
push eax
lea ecx, [esp + 0x360]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x70]
sub ecx, dword [esp + 0x6c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x15
jne 0x40f799
call fcn.004507b0
mov ecx, dword [esp + 0x6c]
push ecx
lea edx, [esp + 0x328]
push esi
push edx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x16
cmp eax, ebp
ja 0x40f7dd
call fcn.004507b0
mov eax, dword [esp + 0x24]
add eax, 0x38
push eax
lea ecx, [esp + 0x2f0]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x17
cmp eax, 6
ja 0x40f825
call fcn.004507b0
mov eax, dword [esp + 0x3c]
add eax, 0xa8
push eax
lea ecx, [esp + 0x2b8]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x18
cmp eax, ebp
ja 0x40f86e
call fcn.004507b0
mov eax, dword [esp + 0x3c]
add eax, 0x38
push eax
lea ecx, [esp + 0x280]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0xa0]
sub ecx, dword [esp + 0x9c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x19
cmp eax, edi
ja 0x40f8bb
call fcn.004507b0
mov eax, dword [esp + 0x9c]
add eax, 0x1c
push eax
lea ecx, [esp + 0x248]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x88]
sub ecx, dword [esp + 0x84]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x1a
cmp eax, edi
ja 0x40f90b
call fcn.004507b0
mov eax, dword [esp + 0x84]
add eax, 0x1c
push eax
lea ecx, [esp + 0x210]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x1b
cmp eax, 3
ja 0x40f956
call fcn.004507b0
mov eax, dword [esp + 0x24]
add eax, 0x54
push eax
lea ecx, [esp + 0x1d8]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x1c
cmp eax, edi
ja 0x40f99d
call fcn.004507b0
mov eax, dword [esp + 0x3c]
add eax, 0x1c
push eax
lea ecx, [esp + 0x1a0]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x54]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x1d
jne 0x40f9e2
call fcn.004507b0
mov ecx, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x184]
push esi
push edx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x1e
cmp eax, 3
ja 0x40fa27
call fcn.004507b0
mov eax, dword [esp + 0x3c]
add eax, 0x54
push eax
lea ecx, [esp + 0x4cc]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x88]
sub ecx, dword [esp + 0x84]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x1f
cmp eax, ebp
ja 0x40fa74
call fcn.004507b0
mov eax, dword [esp + 0x84]
add eax, 0x38
push eax
lea ecx, [esp + 0x30c]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x20
cmp eax, 4
ja 0x40fabf
call fcn.004507b0
mov eax, dword [esp + 0x24]
add eax, 0x70
push eax
lea ecx, [esp + 0x3ec]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0xa0]
sub ecx, dword [esp + 0x9c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x21
jne 0x40fb0a
call fcn.004507b0
mov ecx, dword [esp + 0x9c]
push ecx
lea edx, [esp + 0x2d4]
push esi
push edx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x88]
sub ecx, dword [esp + 0x84]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x22
cmp eax, 3
ja 0x40fb58
call fcn.004507b0
mov eax, dword [esp + 0x84]
add eax, 0x54
push eax
lea ecx, [esp + 0x45c]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x23
cmp eax, 5
ja 0x40fba3
call fcn.004507b0
mov eax, dword [esp + 0x24]
add eax, 0x8c
push eax
lea ecx, [esp + 0x29c]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x70]
sub ecx, dword [esp + 0x6c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x24
cmp eax, 5
ja 0x40fbed
call fcn.004507b0
mov eax, dword [esp + 0x6c]
add eax, 0x8c
push eax
lea ecx, [esp + 0x3b4]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x88]
sub ecx, dword [esp + 0x84]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x25
jne 0x40fc3a
call fcn.004507b0
mov ecx, dword [esp + 0x84]
push ecx
lea edx, [esp + 0x168]
push esi
push edx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x88]
sub ecx, dword [esp + 0x84]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x26
cmp eax, 5
ja 0x40fc88
call fcn.004507b0
mov eax, dword [esp + 0x84]
add eax, 0x8c
push eax
lea ecx, [esp + 0x494]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x27
cmp eax, 6
ja 0x40fcd5
call fcn.004507b0
mov eax, dword [esp + 0x24]
add eax, 0xa8
push eax
lea ecx, [esp + 0x22c]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x70]
sub ecx, dword [esp + 0x6c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x28
cmp eax, ebp
ja 0x40fd1e
call fcn.004507b0
mov eax, dword [esp + 0x6c]
add eax, 0x38
push eax
lea ecx, [esp + 0x37c]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x70]
sub ecx, dword [esp + 0x6c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x29
cmp eax, 4
ja 0x40fd66
call fcn.004507b0
mov eax, dword [esp + 0x6c]
add eax, 0x70
push eax
lea ecx, [esp + 0x1f4]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x2a
cmp eax, 7
ja 0x40fdae
call fcn.004507b0
mov eax, dword [esp + 0x24]
add eax, 0xc4
push eax
lea ecx, [esp + 0x424]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x54]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x2b
cmp eax, 5
ja 0x40fdf8
call fcn.004507b0
mov eax, dword [esp + 0x54]
add eax, 0x8c
push eax
lea ecx, [esp + 0x1bc]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x70]
sub ecx, dword [esp + 0x6c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x2c
cmp eax, 3
ja 0x40fe42
call fcn.004507b0
mov eax, dword [esp + 0x6c]
add eax, 0x54
push eax
lea ecx, [esp + 0x344]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x88]
sub ecx, dword [esp + 0x84]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x2d
cmp eax, 4
ja 0x40fe90
call fcn.004507b0
mov eax, dword [esp + 0x84]
add eax, 0x70
push eax
lea ecx, [esp + 0x4e8]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x2e
cmp eax, 8
ja 0x40fedb
call fcn.004507b0
mov eax, dword [esp + 0x24]
add eax, 0xe0
push eax
lea ecx, [esp + 0x264]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x54]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x2f
cmp eax, 4
ja 0x40ff25
call fcn.004507b0
mov eax, dword [esp + 0x54]
add eax, 0x70
push eax
lea ecx, [esp + 0x124]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x30
cmp eax, 4
ja 0x40ff6d
call fcn.004507b0
mov eax, dword [esp + 0x3c]
add eax, 0x70
push eax
lea ecx, [esp + 0xd0]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x24]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x31
cmp eax, 9
ja 0x40ffb5
call fcn.004507b0
mov eax, dword [esp + 0x24]
add eax, 0xfc
push eax
lea ecx, [esp + 0x108]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x40]
sub ecx, dword [esp + 0x3c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x32
cmp eax, 5
ja 0x40ffff
call fcn.004507b0
mov eax, dword [esp + 0x3c]
add eax, 0x8c
push eax
lea ecx, [esp + 0xec]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov esi, eax
mov ecx, dword [esp + 0x58]
sub ecx, dword [esp + 0x54]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [esp + 0x508], 0x33
cmp eax, 3
ja 0x410049
call fcn.004507b0
mov eax, dword [esp + 0x54]
add eax, 0x54
push eax
lea ecx, [esp + 0xb4]
push esi
push ecx
call fcn.0040acc0
add esp, 0xc
mov ebp, dword [esp + 0xa8]
push 0xffffffffffffffff
push ebx
push eax
mov ecx, ebp
mov byte [esp + 0x514], 0x34
call fcn.00403020
mov esi, 0x10
cmp dword [esp + 0xc8], esi
jb 0x41009a
mov edx, dword [esp + 0xb4]
push edx
call fcn.0044fc16
add esp, 4
mov edi, 0xf
mov dword [esp + 0xc8], edi
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
cmp dword [esp + 0x100], esi
jb 0x4100cd
mov eax, dword [esp + 0xec]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x100], edi
mov dword [esp + 0xfc], ebx
mov byte [esp + 0xec], bl
cmp dword [esp + 0x11c], esi
jb 0x4100fb
mov ecx, dword [esp + 0x108]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x11c], edi
mov dword [esp + 0x118], ebx
mov byte [esp + 0x108], bl
cmp dword [esp + 0xe4], esi
jb 0x410129
mov edx, dword [esp + 0xd0]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
cmp dword [esp + 0x138], esi
jb 0x410157
mov eax, dword [esp + 0x124]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x138], edi
mov dword [esp + 0x134], ebx
mov byte [esp + 0x124], bl
cmp dword [esp + 0x278], esi
jb 0x410185
mov ecx, dword [esp + 0x264]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x278], edi
mov dword [esp + 0x274], ebx
mov byte [esp + 0x264], bl
cmp dword [esp + 0x4fc], esi
jb 0x4101b3
mov edx, dword [esp + 0x4e8]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x4fc], edi
mov dword [esp + 0x4f8], ebx
mov byte [esp + 0x4e8], bl
cmp dword [esp + 0x358], esi
jb 0x4101e1
mov eax, dword [esp + 0x344]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x358], edi
mov dword [esp + 0x354], ebx
mov byte [esp + 0x344], bl
cmp dword [esp + 0x1d0], esi
jb 0x41020f
mov ecx, dword [esp + 0x1bc]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x1d0], edi
mov dword [esp + 0x1cc], ebx
mov byte [esp + 0x1bc], bl
cmp dword [esp + 0x438], esi
jb 0x41023d
mov edx, dword [esp + 0x424]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x438], edi
mov dword [esp + 0x434], ebx
mov byte [esp + 0x424], bl
cmp dword [esp + 0x208], esi
jb 0x41026b
mov eax, dword [esp + 0x1f4]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x208], edi
mov dword [esp + 0x204], ebx
mov byte [esp + 0x1f4], bl
cmp dword [esp + 0x390], esi
jb 0x410299
mov ecx, dword [esp + 0x37c]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x390], edi
mov dword [esp + 0x38c], ebx
mov byte [esp + 0x37c], bl
cmp dword [esp + 0x240], esi
jb 0x4102c7
mov edx, dword [esp + 0x22c]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x240], edi
mov dword [esp + 0x23c], ebx
mov byte [esp + 0x22c], bl
cmp dword [esp + 0x4a8], esi
jb 0x4102f5
mov eax, dword [esp + 0x494]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x4a8], edi
mov dword [esp + 0x4a4], ebx
mov byte [esp + 0x494], bl
cmp dword [esp + 0x17c], esi
jb 0x410323
mov ecx, dword [esp + 0x168]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x17c], edi
mov dword [esp + 0x178], ebx
mov byte [esp + 0x168], bl
cmp dword [esp + 0x3c8], esi
jb 0x410351
mov edx, dword [esp + 0x3b4]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x3c8], edi
mov dword [esp + 0x3c4], ebx
mov byte [esp + 0x3b4], bl
cmp dword [esp + 0x2b0], esi
jb 0x41037f
mov eax, dword [esp + 0x29c]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x2b0], edi
mov dword [esp + 0x2ac], ebx
mov byte [esp + 0x29c], bl
cmp dword [esp + 0x470], esi
jb 0x4103ad
mov ecx, dword [esp + 0x45c]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x470], edi
mov dword [esp + 0x46c], ebx
mov byte [esp + 0x45c], bl
cmp dword [esp + 0x2e8], esi
jb 0x4103db
mov edx, dword [esp + 0x2d4]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x2e8], edi
mov dword [esp + 0x2e4], ebx
mov byte [esp + 0x2d4], bl
cmp dword [esp + 0x400], esi
jb 0x410409
mov eax, dword [esp + 0x3ec]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x400], edi
mov dword [esp + 0x3fc], ebx
mov byte [esp + 0x3ec], bl
cmp dword [esp + 0x320], esi
jb 0x410437
mov ecx, dword [esp + 0x30c]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x320], edi
mov dword [esp + 0x31c], ebx
mov byte [esp + 0x30c], bl
cmp dword [esp + 0x4e0], esi
jb 0x410465
mov edx, dword [esp + 0x4cc]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x4e0], edi
mov dword [esp + 0x4dc], ebx
mov byte [esp + 0x4cc], bl
cmp dword [esp + 0x198], esi
jb 0x410493
mov eax, dword [esp + 0x184]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x198], edi
mov dword [esp + 0x194], ebx
mov byte [esp + 0x184], bl
cmp dword [esp + 0x1b4], esi
jb 0x4104c1
mov ecx, dword [esp + 0x1a0]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x1b4], edi
mov dword [esp + 0x1b0], ebx
mov byte [esp + 0x1a0], bl
cmp dword [esp + 0x1ec], esi
jb 0x4104ef
mov edx, dword [esp + 0x1d8]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x1ec], edi
mov dword [esp + 0x1e8], ebx
mov byte [esp + 0x1d8], bl
cmp dword [esp + 0x224], esi
jb 0x41051d
mov eax, dword [esp + 0x210]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x224], edi
mov dword [esp + 0x220], ebx
mov byte [esp + 0x210], bl
cmp dword [esp + 0x25c], esi
jb 0x41054b
mov ecx, dword [esp + 0x248]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x25c], edi
mov dword [esp + 0x258], ebx
mov byte [esp + 0x248], bl
cmp dword [esp + 0x294], esi
jb 0x410579
mov edx, dword [esp + 0x280]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x294], edi
mov dword [esp + 0x290], ebx
mov byte [esp + 0x280], bl
cmp dword [esp + 0x2cc], esi
jb 0x4105a7
mov eax, dword [esp + 0x2b8]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x2cc], edi
mov dword [esp + 0x2c8], ebx
mov byte [esp + 0x2b8], bl
cmp dword [esp + 0x304], esi
jb 0x4105d5
mov ecx, dword [esp + 0x2f0]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x304], edi
mov dword [esp + 0x300], ebx
mov byte [esp + 0x2f0], bl
cmp dword [esp + 0x33c], esi
jb 0x410603
mov edx, dword [esp + 0x328]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x33c], edi
mov dword [esp + 0x338], ebx
mov byte [esp + 0x328], bl
cmp dword [esp + 0x374], esi
jb 0x410631
mov eax, dword [esp + 0x360]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x374], edi
mov dword [esp + 0x370], ebx
mov byte [esp + 0x360], bl
cmp dword [esp + 0x3ac], esi
jb 0x41065f
mov ecx, dword [esp + 0x398]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x3ac], edi
mov dword [esp + 0x3a8], ebx
mov byte [esp + 0x398], bl
cmp dword [esp + 0x3e4], esi
jb 0x41068d
mov edx, dword [esp + 0x3d0]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x3e4], edi
mov dword [esp + 0x3e0], ebx
mov byte [esp + 0x3d0], bl
cmp dword [esp + 0x41c], esi
jb 0x4106bb
mov eax, dword [esp + 0x408]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x41c], edi
mov dword [esp + 0x418], ebx
mov byte [esp + 0x408], bl
cmp dword [esp + 0x454], esi
jb 0x4106e9
mov ecx, dword [esp + 0x440]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x454], edi
mov dword [esp + 0x450], ebx
mov byte [esp + 0x440], bl
cmp dword [esp + 0x48c], esi
jb 0x410717
mov edx, dword [esp + 0x478]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x48c], edi
mov dword [esp + 0x488], ebx
mov byte [esp + 0x478], bl
cmp dword [esp + 0x4c4], esi
jb 0x410745
mov eax, dword [esp + 0x4b0]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x4c4], edi
mov dword [esp + 0x4c0], ebx
mov byte [esp + 0x4b0], bl
cmp dword [esp + 0x154], esi
jb 0x410773
mov ecx, dword [esp + 0x140]
push ecx
call fcn.0044fc16
add esp, 4
lea ecx, [esp + 0x78]
call fcn.00407890
lea ecx, [esp + 0x30]
call fcn.00407890
lea ecx, [esp + 0x48]
call fcn.00407890
lea ecx, [esp + 0x90]
call fcn.00407890
lea ecx, [esp + 0x60]
call fcn.00407890
lea ecx, [esp + 0x18]
call fcn.00407890
cmp dword [esp + 0x52c], esi
jb 0x4107c5
mov edx, dword [esp + 0x518]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x52c], edi
mov dword [esp + 0x528], ebx
mov byte [esp + 0x518], bl
cmp dword [esp + 0x548], esi
jb 0x4107f3
mov eax, dword [esp + 0x534]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x548], edi
mov dword [esp + 0x544], ebx
mov byte [esp + 0x534], bl
cmp dword [esp + 0x564], esi
jb 0x410821
mov ecx, dword [esp + 0x550]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x564], edi
mov dword [esp + 0x560], ebx
mov byte [esp + 0x550], bl
cmp dword [esp + 0x580], esi
jb 0x41084f
mov edx, dword [esp + 0x56c]
push edx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x580], edi
mov dword [esp + 0x57c], ebx
mov byte [esp + 0x56c], bl
cmp dword [esp + 0x59c], esi
jb 0x41087d
mov eax, dword [esp + 0x588]
push eax
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x59c], edi
mov dword [esp + 0x598], ebx
mov byte [esp + 0x588], bl
cmp dword [esp + 0x5b8], esi
jb 0x4108ab
mov ecx, dword [esp + 0x5a4]
push ecx
call fcn.0044fc16
add esp, 4
mov dword [esp + 0x5b8], edi
mov dword [esp + 0x5b4], ebx
mov byte [esp + 0x5a4], bl
cmp dword [esp + 0x5d4], esi
jb 0x4108d9
mov edx, dword [esp + 0x5c0]
push edx
call fcn.0044fc16
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x500]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4f8
ret