Function at 0x402170
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495f02
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0x4c4018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x368], ecx
mov dword [ebp - 0x380], esi
call dword [0x49902c]
call dword [0x4981a4]
lea edx, [ebp - 0x360]
push edx
mov edi, eax
call fcn.004056e0
add esp, 4
mov eax, dword [eax]
mov dword [eax + 0x50], edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x360]
cmp ecx, esi
je 0x402231
mov esi, ecx
call dword [0x4980a8]
test al, al
je 0x40222f
mov dword [ebp - 0x380], esi
test esi, esi
je 0x40222f
lea ecx, [esi + 8]
mov dword [ebp - 4], 1
call dword [0x4980ac]
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call dword [0x4980a0]
push esi
call dword [0x498360]
add esp, 4
xor esi, esi
call dword [0x499028]
cmp eax, 2
jg 0x402319
xor ebx, ebx
lea esi, [ebx + 6]
mov eax, 0x499534
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x360], 0xb3
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x228], ebx
mov byte [ebp - 0x238], bl
call fcn.004042c0
mov dword [ebp - 4], 2
lea esi, [ebx + 0xb]
mov eax, 0x49953c
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x358], 1
mov dword [ebp - 0x240], 0xf
mov dword [ebp - 0x244], ebx
mov byte [ebp - 0x254], bl
call fcn.004042c0
mov eax, 3
mov dword [ebp - 4], eax
push 2
mov dword [ebp - 0x358], eax
lea eax, [ebp - 0x360]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x254]
push edx
lea ecx, [ebp - 0x37c]
call dword [0x499020]
push edi
push ecx
mov dword [ebp - 4], 4
push 0x4994fc
mov ecx, eax
mov dword [ebp - 0x358], 7
call dword [0x499024]
push eax
call fcn.00404840
add esp, 0xc
mov ecx, eax
call dword [0x4982b4]
mov ebx, dword [ebp - 0x358]
xor esi, esi
mov dword [ebp - 4], 3
test bl, 4
je 0x40233a
and ebx, 0xfffffffb
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x358], ebx
call dword [0x49901c]
test bl, 2
je 0x402378
and ebx, 0xfffffffd
cmp dword [ebp - 0x240], 0x10
mov dword [ebp - 0x358], ebx
jb 0x402361
mov eax, dword [ebp - 0x254]
push eax
call dword [0x498360]
add esp, 4
mov dword [ebp - 0x240], 0xf
mov dword [ebp - 0x244], esi
mov byte [ebp - 0x254], 0
test bl, 1
je 0x40239f
and ebx, 0xfffffffe
cmp dword [ebp - 0x224], 0x10
mov dword [ebp - 0x358], ebx
jb 0x40239f
mov ecx, dword [ebp - 0x238]
push ecx
call dword [0x498360]
add esp, 4
push esi
call dword [0x498d34]
push 0x8001
call dword [0x498234]
mov edi, dword [0x4981c0]
push 0x4994dc
call edi
mov dword [ebp - 0x380], eax
push 0x49949c
mov dword [ebp - 4], 5
call edi
mov edi, eax
cmp edi, esi
je 0x4023f6
push 0x4994b4
push edi
call dword [0x4981bc]
cmp eax, esi
je 0x4023ef
push 0x499548
call eax
push edi
call dword [0x4981a8]
lea ecx, [ebp - 0x3d0]
call dword [0x49808c]
mov byte [ebp - 4], 6
call dword [0x499018]
call dword [0x499014]
call dword [0x499010]
mov eax, 7
xor edx, edx
mov byte [ebp - 0x2ec], 0
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2d8], esi
mov word [ebp - 0x2e8], dx
mov word [ebp - 0x2cc], pe_nt_image_headers32
mov dword [ebp - 0x2c8], esi
mov dword [ebp - 0x2c4], esi
mov dword [ebp - 0x2c0], esi
xor ecx, ecx
mov word [ebp - 0x2b8], dx
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x2a4], esi
mov word [ebp - 0x2b4], cx
mov byte [ebp - 4], 9
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x368]
mov word [ebp - 0x298], dx
mov dword [ebp - 0x288], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x402490
mov edi, dword [ebp - 0x368]
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [ebp - 0x298]
call fcn.00401950
mov dword [ebp - 0x27c], 0
mov word [ebp - 0x278], 0
lea eax, [ebp - 0x2ec]
push eax
mov byte [ebp - 4], 0xa
call fcn.0040bb60
test al, al
jne 0x4027ee
push 0x499578
call dword [0x49900c]
add esp, 4
push 0x1388
call dword [0x49819c]
call dword [0x499008]
call dword [0x499028]
mov edi, 0xf
cmp eax, 2
jg 0x4025e7
lea esi, [edi - 9]
mov eax, 0x499534
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x360], 0xcc
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x238], 0
call fcn.004042c0
mov byte [ebp - 4], 0xb
or ebx, 8
lea esi, [edi - 4]
mov eax, 0x49953c
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x254], 0
call fcn.004042c0
push 2
lea ecx, [ebp - 0x360]
push ecx
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x254]
mov dword [ebp - 4], 0xc
or ebx, 0x10
push eax
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x358], ebx
call dword [0x499020]
mov esi, eax
mov dword [ebp - 4], 0xd
or ebx, 0x20
mov dword [ebp - 0x358], ebx
call dword [0x4981a4]
push eax
push ecx
push 0x4995c8
mov ecx, esi
call dword [0x499024]
push eax
call fcn.00404840
add esp, 0xc
mov ecx, eax
call dword [0x4982b4]
mov dword [ebp - 4], 0xc
test bl, 0x20
je 0x402608
and ebx, 0xffffffdf
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x358], ebx
call dword [0x49901c]
mov esi, 0x10
test bl, 0x10
je 0x402644
and ebx, 0xffffffef
cmp dword [ebp - 0x240], esi
jb 0x40262d
mov ecx, dword [ebp - 0x254]
push ecx
call dword [0x498360]
add esp, 4
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x254], 0
mov dword [ebp - 4], 0xa
test bl, 8
je 0x40266b
and ebx, 0xfffffff7
cmp dword [ebp - 0x224], esi
jb 0x40266b
mov edx, dword [ebp - 0x238]
push edx
call dword [0x498360]
add esp, 4
call dword [0x499004]
call dword [0x499028]
cmp eax, 2
jg 0x402761
mov esi, 6
mov eax, 0x499534
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x360], 0xce
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x238], 0
call fcn.004042c0
mov byte [ebp - 4], 0xe
or ebx, 0x40
mov esi, 0xb
mov eax, 0x49953c
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x254], 0
call fcn.004042c0
push 2
lea eax, [ebp - 0x360]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x254]
mov dword [ebp - 4], edi
or ebx, 0x80
push edx
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x358], ebx
call dword [0x499020]
mov esi, eax
mov dword [ebp - 4], 0x10
or ebx, 0x100
mov dword [ebp - 0x358], ebx
call dword [0x4981a4]
push eax
push ecx
push 0x499610
mov ecx, esi
call dword [0x499024]
push eax
call fcn.00404840
add esp, 0xc
mov ecx, eax
call dword [0x4982b4]
mov esi, 0x10
mov dword [ebp - 4], edi
test ebx, 0x100
je 0x402784
and ebx, 0xfffffeff
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x358], ebx
call dword [0x49901c]
test bl, bl
jns 0x4027bd
and ebx, 0xffffff7f
cmp dword [ebp - 0x240], esi
jb 0x4027a6
mov eax, dword [ebp - 0x254]
push eax
call dword [0x498360]
add esp, 4
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x254], 0
mov dword [ebp - 4], 0xa
test bl, 0x40
je 0x4037c5
cmp dword [ebp - 0x224], esi
jb 0x4037c5
mov ecx, dword [ebp - 0x238]
push ecx
call dword [0x498360]
add esp, 4
jmp 0x4037c5
push 0x499198
xor esi, esi
push esi
push 0x1f0001
mov dword [ebp - 0x388], esi
call dword [0x4981b8]
test eax, eax
jne 0x402862
push 1
lea edx, [ebp - 0x24c]
push edx
call dword [0x498004]
push esi
push esi
push 1
lea eax, [ebp - 0x24c]
push eax
call dword [0x498008]
push 0x499198
push esi
lea edx, [ebp - 0x37c]
lea ecx, [ebp - 0x24c]
push edx
mov dword [ebp - 0x37c], 0xc
mov dword [ebp - 0x374], esi
mov dword [ebp - 0x378], ecx
call dword [str.3D_03D__]
mov dword [ebp - 0x388], eax
jmp 0x40286e
push eax
call dword [0x4981b4]
mov esi, 1
call dword [0x499000]
mov byte [ebp - 0x359], al
test al, al
jne 0x402bb7
test esi, esi
je 0x402bb7
push edi
call fcn.00401f90
add esp, 4
call dword [0x499008]
call dword [0x499028]
mov edi, 0xf
cmp eax, 2
jg 0x40298c
lea esi, [edi - 9]
mov eax, 0x499534
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x360], 0xda
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x238], 0
call fcn.004042c0
mov byte [ebp - 4], 0x11
or ebx, 0x200
lea esi, [edi - 4]
mov eax, 0x49953c
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x254], 0
call fcn.004042c0
push 2
lea eax, [ebp - 0x360]
push eax
lea ecx, [ebp - 0x238]
push ecx
lea edx, [ebp - 0x254]
mov dword [ebp - 4], 0x12
or ebx, 0x400
push edx
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x358], ebx
call dword [0x499020]
mov esi, eax
mov dword [ebp - 4], 0x13
or ebx, 0x800
mov dword [ebp - 0x358], ebx
call dword [0x4981a4]
push eax
push ecx
push 0x4995c8
mov ecx, esi
call dword [0x499024]
push eax
call fcn.00404840
add esp, 0xc
mov ecx, eax
call dword [0x4982b4]
mov dword [ebp - 4], 0x12
test ebx, 0x800
je 0x4029b3
and ebx, 0xfffff7ff
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x358], ebx
call dword [0x49901c]
mov esi, 0x10
test ebx, 0x400
je 0x4029f5
and ebx, 0xfffffbff
cmp dword [ebp - 0x240], esi
jb 0x4029de
mov eax, dword [ebp - 0x254]
push eax
call dword [0x498360]
add esp, 4
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x254], 0
mov dword [ebp - 4], 0xa
test ebx, 0x200
je 0x402a22
and ebx, 0xfffffdff
cmp dword [ebp - 0x224], esi
jb 0x402a22
mov ecx, dword [ebp - 0x238]
push ecx
call dword [0x498360]
add esp, 4
call dword [0x499004]
call dword [0x499028]
cmp eax, 2
jg 0x402b1f
mov esi, 6
mov eax, 0x499534
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x360], 0xdc
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x238], 0
call fcn.004042c0
mov byte [ebp - 4], 0x14
or ebx, 0x1000
mov esi, 0xb
mov eax, 0x49953c
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x254], 0
call fcn.004042c0
push 2
lea edx, [ebp - 0x360]
push edx
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x254]
push ecx
mov dword [ebp - 4], 0x15
or ebx, 0x2000
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x358], ebx
call dword [0x499020]
mov esi, eax
mov dword [ebp - 4], 0x16
or ebx, 0x4000
mov dword [ebp - 0x358], ebx
call dword [0x4981a4]
push eax
push ecx
push 0x499610
mov ecx, esi
call dword [0x499024]
push eax
call fcn.00404840
add esp, 0xc
mov ecx, eax
call dword [0x4982b4]
mov esi, 0x10
mov dword [ebp - 4], 0x15
test ebx, 0x4000
je 0x402b46
and ebx, 0xffffbfff
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x358], ebx
call dword [0x49901c]
test ebx, 0x2000
je 0x402b83
and ebx, 0xffffdfff
cmp dword [ebp - 0x240], esi
jb 0x402b6c
mov edx, dword [ebp - 0x254]
push edx
call dword [0x498360]
add esp, 4
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x254], 0
mov dword [ebp - 4], 0xa
test ebx, 0x1000
je 0x4037c5
cmp dword [ebp - 0x224], esi
jb 0x4037c5
mov eax, dword [ebp - 0x238]
push eax
call dword [0x498360]
add esp, 4
jmp 0x4037c5
mov edi, dword [0x49836c]
push 4
call edi
add esp, 4
test eax, eax
je 0x402bd0
mov dword [eax], 0x49976c
jmp 0x402bd2
xor eax, eax
mov dword [ebp - 0x370], eax
lea ecx, [ebp - 0x36c]
push ecx
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0x17
call fcn.00404aa0
mov ecx, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x368], ecx
mov byte [ebp - 4], 0x19
call fcn.00401df0
mov esi, eax
lea edx, [ebp - 0x360]
push edx
lea ecx, [ebp - 0x368]
mov byte [ebp - 4], 0x1a
call fcn.00403e00
mov byte [ebp - 4], 0x1b
mov edx, dword [eax]
push ecx
mov ecx, esp
mov dword [eax], 0
mov dword [ecx], edx
mov ecx, dword [esi + 4]
mov dword [ebp - 0x384], esp
call dword [0x498088]
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x360]
test ecx, ecx
je 0x402c53
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov byte [ebp - 4], 0x18
mov ecx, dword [ebp - 0x368]
test ecx, ecx
je 0x402c69
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x36c]
test ecx, ecx
je 0x402c7f
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
call fcn.0040d4b0
push 0
lea ecx, [ebp - 0x298]
push ecx
lea ecx, [eax + 8]
or eax, 0xffffffff
call fcn.00401750
call fcn.0040d4b0
push eax
call fcn.0040f290
test al, al
je 0x402cb8
call dword [0x499008]
call dword [0x499004]
jmp 0x4037af
push 0x338
call edi
add esp, 4
mov dword [ebp - 0x384], eax
mov byte [ebp - 4], 0x1c
test eax, eax
je 0x402ce0
push eax
call fcn.00412ac0
mov esi, eax
mov dword [ebp - 0x368], eax
jmp 0x402ce8
xor esi, esi
mov dword [ebp - 0x368], esi
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x384], esi
test esi, esi
je 0x402cff
lea ecx, [esi + 0x20]
call dword [0x4980a4]
mov byte [ebp - 4], 0x1d
test esi, esi
je 0x4037af
mov edi, dword [ebp - 0x364]
push edi
mov dword [0x4c89a4], esi
call dword [0x498b90]
add esp, 4
test ebx, 0x20000000
je 0x402d41
and ebx, 0xdfffffff
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x358], ebx
call dword [0x498060]
lea ecx, [ebp - 0x354]
push ecx
mov dword [esi + 0x2d0], edi
call dword [0x498b5c]
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0x1e
call dword [0x498b8c]
push eax
lea edx, [ebp - 0x21c]
push edx
call dword [0x4984a8]
lea ecx, [ebp - 0x354]
mov byte [ebp - 4], 0x1d
call dword [0x498b58]
mov esi, dword [0x4984ac]
push 0x499668
lea eax, [ebp - 0x21c]
push eax
call esi
mov edi, dword [0x498380]
lea ecx, [ebp - 0x21c]
push 0
push ecx
call edi
add esp, 8
cmp eax, 0xffffffff
jne 0x402e0a
mov edi, edi
lea edx, [ebp - 0x21c]
push edx
call dword [0x4984a4]
lea eax, [ebp - 0x21c]
push eax
call dword [0x4984a4]
lea ecx, [ebp - 0x21c]
push ecx
call dword [0x4984b0]
test eax, eax
jne 0x402e0a
push 0x4990ec
lea edx, [ebp - 0x21c]
push edx
call esi
push 0x499668
lea eax, [ebp - 0x21c]
push eax
call esi
lea ecx, [ebp - 0x21c]
push 0
push ecx
call edi
add esp, 8
cmp eax, 0xffffffff
je 0x402db0
lea edx, [ebp - 0x21c]
push edx
call dword [0x498b54]
add esp, 4
test byte [0x4c8bb8], 1
jne 0x402e44
or dword [0x4c8bb8], 1
mov byte [ebp - 4], 0x1f
call fcn.00442c30
push 0x496ef0
call fcn.00486525
add esp, 4
mov byte [ebp - 4], 0x1d
mov eax, dword [0x4c8b84]
mov edx, dword [eax + 4]
mov ecx, 0x4c8b84
call edx
push 8
call dword [0x49836c]
mov esi, eax
add esp, 4
mov dword [ebp - 0x364], esi
mov byte [ebp - 4], 0x20
test esi, esi
je 0x402e7f
lea ecx, [esi + 4]
call dword [0x4980d8]
mov dword [esi], 0x49b6e0
jmp 0x402e81
xor esi, esi
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x360], esi
mov dword [ebp - 0x39c], esi
test esi, esi
je 0x402e9e
lea ecx, [esi + 4]
call dword [0x4980a4]
mov byte [ebp - 4], 0x21
test ebx, 0x40000000
je 0x402ec2
and ebx, 0xbfffffff
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x358], ebx
call dword [0x498060]
push esi
call fcn.0041b980
test ebx, ebx
jns 0x402ee4
and ebx, 0x7fffffff
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x358], ebx
call dword [0x498060]
push esi
call fcn.0041cb80
mov ecx, esi
call fcn.0041d1d0
lea eax, [ebp - 0x364]
push eax
call fcn.004056e0
add esp, 4
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x27c]
mov eax, dword [eax]
push ecx
push eax
call fcn.004058c0
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x364]
test ecx, ecx
je 0x402f5a
mov esi, ecx
call dword [0x4980a8]
test al, al
je 0x402f5a
mov dword [ebp - 0x36c], esi
test esi, esi
je 0x402f5a
lea ecx, [esi + 8]
mov byte [ebp - 4], 0x23
call dword [0x4980ac]
mov ecx, esi
mov byte [ebp - 4], 0x21
call dword [0x4980a0]
push esi
call dword [0x498360]
add esp, 4
lea edx, [ebp - 0x364]
push edx
call fcn.004056e0
add esp, 4
mov byte [ebp - 4], 0x24
mov ecx, dword [eax]
push 0
call fcn.00407ab0
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x364]
test ecx, ecx
je 0x402fbd
mov esi, ecx
call dword [0x4980a8]
test al, al
je 0x402fbd
mov dword [ebp - 0x36c], esi
test esi, esi
je 0x402fbd
lea ecx, [esi + 8]
mov byte [ebp - 4], 0x25
call dword [0x4980ac]
mov ecx, esi
mov byte [ebp - 4], 0x21
call dword [0x4980a0]
push esi
call dword [0x498360]
add esp, 4
mov ebx, dword [ebp - 0x368]
call int.0041a580
lea ecx, [ebp - 0x2ec]
call fcn.0040c620
mov ecx, ebx
call 0x41a260
call dword [0x4981a4]
mov edi, eax
call dword [0x499028]
cmp eax, 2
jg 0x403120
mov esi, 6
mov eax, 0x499534
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x364], 0x113
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x238], 0
call fcn.004042c0
mov byte [ebp - 4], 0x26
mov ebx, dword [ebp - 0x358]
or ebx, 0x8000
mov esi, 0xb
mov eax, 0x49953c
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x25c], 0xf
mov dword [ebp - 0x260], 0
mov byte [ebp - 0x270], 0
call fcn.004042c0
lea eax, [ebp - 0x36c]
mov dword [ebp - 4], 0x27
or ebx, 0x10000
push eax
mov dword [ebp - 0x358], ebx
call fcn.004056e0
add esp, 4
mov esi, eax
push 2
lea ecx, [ebp - 0x364]
push ecx
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x270]
mov dword [ebp - 4], 0x28
or ebx, 0x20000
push eax
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], ebx
call dword [0x499020]
mov dword [ebp - 4], 0x29
mov esi, dword [esi]
mov esi, dword [esi + 0x50]
mov ecx, edi
sub ecx, esi
push ecx
push ecx
push 0x499674
push edi
or ebx, 0x40000
push 0x499694
mov ecx, eax
mov dword [ebp - 0x358], ebx
call dword [0x499024]
push eax
call fcn.00404840
add esp, 8
mov ecx, eax
call dword [0x4982b4]
push eax
call fcn.00404840
add esp, 0xc
mov ecx, eax
call dword [0x4982b4]
jmp 0x403126
mov ebx, dword [ebp - 0x358]
mov dword [ebp - 4], 0x28
test ebx, 0x40000
je 0x40314d
and ebx, 0xfffbffff
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], ebx
call dword [0x49901c]
mov dword [ebp - 4], 0x27
test ebx, 0x20000
je 0x4031b2
mov ecx, dword [ebp - 0x36c]
and ebx, 0xfffdffff
mov dword [ebp - 0x358], ebx
test ecx, ecx
je 0x4031b2
mov esi, ecx
call dword [0x4980a8]
test al, al
je 0x4031b2
mov dword [ebp - 0x398], esi
test esi, esi
je 0x4031b2
lea ecx, [esi + 8]
mov dword [ebp - 4], 0x2a
call dword [0x4980ac]
mov ecx, esi
mov byte [ebp - 4], 0x27
call dword [0x4980a0]
mov edi, dword [0x498360]
push esi
call edi
add esp, 4
jmp 0x4031b8
mov edi, dword [0x498360]
test ebx, 0x10000
je 0x4031f6
and ebx, 0xfffeffff
cmp dword [ebp - 0x25c], 0x10
jb 0x4031db
mov edx, dword [ebp - 0x270]
push edx
call edi
add esp, 4
mov dword [ebp - 0x25c], 0xf
mov dword [ebp - 0x260], 0
mov byte [ebp - 0x270], 0
mov esi, 0x10
mov dword [ebp - 4], 0x21
test ebx, 0x8000
je 0x403224
and ebx, 0xffff7fff
cmp dword [ebp - 0x224], esi
jb 0x403224
mov eax, dword [ebp - 0x238]
push eax
call edi
add esp, 4
lea ecx, [ebp - 0x3ec]
call dword [0x498094]
lea ecx, [ebp - 0x3ec]
mov byte [ebp - 4], 0x2b
call dword [0x49809c]
cmp byte [ebp - 0x359], 0
jne 0x403256
mov ecx, dword [ebp - 0x388]
push ecx
call dword [0x4981b4]
call dword [0x499008]
call dword [0x499028]
cmp eax, 2
jg 0x40336c
xor edi, edi
lea esi, [edi + 6]
mov eax, 0x499534
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x364], 0x11d
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x238], 0
call fcn.004042c0
mov byte [ebp - 4], 0x2c
or ebx, 0x80000
lea esi, [edi + 0xb]
mov eax, 0x49953c
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x25c], 0xf
mov dword [ebp - 0x260], edi
mov byte [ebp - 0x270], 0
call fcn.004042c0
push 2
lea edx, [ebp - 0x364]
push edx
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x270]
push ecx
mov dword [ebp - 4], 0x2d
or ebx, 0x100000
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], ebx
call dword [0x499020]
mov esi, eax
mov dword [ebp - 4], 0x2e
or ebx, 0x200000
mov dword [ebp - 0x358], ebx
call dword [0x4981a4]
push eax
push ecx
push 0x4995c8
mov ecx, esi
call dword [0x499024]
push eax
call fcn.00404840
add esp, 0xc
mov ecx, eax
call dword [0x4982b4]
push eax
lea ecx, [ebp - 0x359]
call dword [0x498ff4]
mov ecx, eax
call dword [0x498ff8]
mov edi, dword [0x498360]
mov esi, 0x10
mov dword [ebp - 4], 0x2d
test ebx, 0x200000
je 0x403393
and ebx, 0xffdfffff
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], ebx
call dword [0x49901c]
test ebx, 0x100000
je 0x4033d0
and ebx, 0xffefffff
cmp dword [ebp - 0x25c], esi
jb 0x4033b5
mov edx, dword [ebp - 0x270]
push edx
call edi
add esp, 4
mov dword [ebp - 0x25c], 0xf
mov dword [ebp - 0x260], 0
mov byte [ebp - 0x270], 0
mov dword [ebp - 4], 0x2b
test ebx, 0x80000
je 0x4033f9
and ebx, 0xfff7ffff
cmp dword [ebp - 0x224], esi
jb 0x4033f9
mov eax, dword [ebp - 0x238]
push eax
call edi
add esp, 4
call dword [0x499004]
call dword [0x499028]
cmp eax, 2
jg 0x40350f
xor edi, edi
lea esi, [edi + 6]
mov eax, 0x499534
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x364], 0x120
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x228], edi
mov byte [ebp - 0x238], 0
call fcn.004042c0
mov byte [ebp - 4], 0x2f
or ebx, 0x400000
lea esi, [edi + 0xb]
mov eax, 0x49953c
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x25c], 0xf
mov dword [ebp - 0x260], edi
mov byte [ebp - 0x270], 0
call fcn.004042c0
push 2
lea ecx, [ebp - 0x364]
push ecx
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x270]
mov dword [ebp - 4], 0x30
or ebx, 0x800000
push eax
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], ebx
call dword [0x499020]
mov esi, eax
mov dword [ebp - 4], 0x31
or ebx, 0x1000000
mov dword [ebp - 0x358], ebx
call dword [0x4981a4]
push eax
push ecx
push 0x499610
mov ecx, esi
call dword [0x499024]
push eax
call fcn.00404840
add esp, 0xc
mov ecx, eax
call dword [0x4982b4]
push eax
lea ecx, [ebp - 0x359]
call dword [0x498ff4]
mov ecx, eax
call dword [0x498ff8]
mov edi, dword [0x498360]
mov esi, 0x10
mov dword [ebp - 4], 0x30
test ebx, 0x1000000
je 0x403536
and ebx, 0xfeffffff
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], ebx
call dword [0x49901c]
test ebx, 0x800000
je 0x403573
and ebx, 0xff7fffff
cmp dword [ebp - 0x25c], esi
jb 0x403558
mov ecx, dword [ebp - 0x270]
push ecx
call edi
add esp, 4
mov dword [ebp - 0x25c], 0xf
mov dword [ebp - 0x260], 0
mov byte [ebp - 0x270], 0
mov dword [ebp - 4], 0x2b
test ebx, 0x400000
je 0x40359c
and ebx, 0xffbfffff
cmp dword [ebp - 0x224], esi
jb 0x40359c
mov edx, dword [ebp - 0x238]
push edx
call edi
add esp, 4
mov eax, dword [0x4c8b84]
mov edx, dword [eax + 8]
mov ecx, 0x4c8b84
call edx
call dword [0x499028]
cmp eax, 2
jg 0x4036bb
xor edi, edi
lea esi, [edi + 6]
mov eax, 0x499534
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x36c], 0x124
mov dword [ebp - 0x2f4], 0xf
mov dword [ebp - 0x2f8], edi
mov byte [ebp - 0x308], 0
call fcn.004042c0
mov byte [ebp - 4], 0x32
or ebx, 0x2000000
lea esi, [edi + 0xb]
mov eax, 0x49953c
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x358], ebx
mov dword [ebp - 0x25c], 0xf
mov dword [ebp - 0x260], edi
mov byte [ebp - 0x270], 0
call fcn.004042c0
push 2
lea eax, [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x308]
push ecx
lea edx, [ebp - 0x270]
mov dword [ebp - 4], 0x33
or ebx, 0x4000000
push edx
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], ebx
call dword [0x499020]
mov esi, eax
mov dword [ebp - 4], 0x34
or ebx, 0x8000000
mov dword [ebp - 0x358], ebx
call dword [0x4981a4]
push eax
push ecx
push 0x4996c8
mov ecx, esi
call dword [0x499024]
push eax
call fcn.00404840
add esp, 0xc
mov ecx, eax
call dword [0x4982b4]
push eax
lea ecx, [ebp - 0x359]
call dword [0x498ff4]
mov ecx, eax
call dword [0x498ff8]
mov edi, dword [0x498360]
mov esi, 0x10
mov dword [ebp - 4], 0x33
test ebx, 0x8000000
je 0x4036e2
and ebx, 0xf7ffffff
lea ecx, [ebp - 0x394]
mov dword [ebp - 0x358], ebx
call dword [0x49901c]
test ebx, 0x4000000
je 0x40371f
and ebx, 0xfbffffff
cmp dword [ebp - 0x25c], esi
jb 0x403704
mov eax, dword [ebp - 0x270]
push eax
call edi
add esp, 4
mov dword [ebp - 0x25c], 0xf
mov dword [ebp - 0x260], 0
mov byte [ebp - 0x270], 0
mov dword [ebp - 4], 0x2b
test ebx, 0x2000000
je 0x403742
cmp dword [ebp - 0x2f4], esi
jb 0x403742
mov ecx, dword [ebp - 0x308]
push ecx
call edi
add esp, 4
lea ecx, [ebp - 0x3ec]
mov byte [ebp - 4], 0x21
call dword [0x498098]
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x360]
test eax, eax
je 0x403782
lea esi, [eax + 4]
mov ecx, esi
call dword [0x4980a8]
test al, al
je 0x403782
test esi, esi
je 0x403782
lea ecx, [esi - 4]
test ecx, ecx
je 0x403782
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov byte [ebp - 4], 0x17
mov esi, dword [ebp - 0x368]
add esi, 0x20
mov ecx, esi
call dword [0x4980a8]
test al, al
je 0x4037af
test esi, esi
je 0x4037af
lea ecx, [esi - 0x20]
test ecx, ecx
je 0x4037af
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
push 1
call eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x370]
test ecx, ecx
je 0x4037c5
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
lea esi, [ebp - 0x2ec]
call fcn.0040bab0
lea ecx, [ebp - 0x3d0]
mov byte [ebp - 4], 5
call dword [0x498090]
call dword [0x498ffc]
call dword [0x498d30]
mov eax, dword [ebp - 0x380]
test eax, eax
je 0x4037fd
push eax
call dword [0x4981a8]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00486130
mov esp, ebp
pop ebp
ret 4