Function at 0x407df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x413791
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
mov eax, dword [ecx]
push ebx
xor ebx, ebx
mov dword [esp + 0x2c], ecx
cmp eax, ebx
jne 0x407e1f
xor eax, eax
jmp 0x408d03
push ebx
push ebx
lea ecx, [esp + 0xc]
call fcn.00409f60
mov dword [esp + 4], 0x4155cc
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov al, byte [0x4196f9]
mov dword [esp + 0xb4], ebx
test al, 1
jne 0x407e9a
or al, 1
mov ecx, 0x419700
mov byte [0x4196f9], al
call fcn.00407bc0
push str.___:____d_.__
lea ecx, [esp + 0x68]
call fcn.00407b90
mov eax, dword [eax + 8]
push ebx
push eax
push str.___:____d_.__
mov ecx, 0x419700
mov byte [esp + 0xc0], 2
call fcn.00407d40
push 0x408e20
mov byte [esp + 0xb8], 0
call fcn.004126ec
add esp, 4
push ebp
push esi
lea ecx, [esp + 0xa0]
call fcn.00409600
mov ebp, dword [esp + 0xe0]
mov byte [esp + 0xbc], 4
cmp ebp, ebx
jne 0x407ec2
lea ebp, [esp + 0xa0]
mov ecx, dword [0x419700]
mov eax, dword [esp + 0xe4]
mov esi, dword [esp + 0xd0]
cmp ecx, ebx
jne 0x407ee0
mov dword [esp + 0x2c], ebx
jmp 0x407f45
cmp eax, ebx
jne 0x407f11
push 0x54
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x20], eax
cmp eax, ebx
mov byte [esp + 0xbc], 5
je 0x407f07
mov ecx, eax
call fcn.00409950
jmp 0x407f09
xor eax, eax
mov byte [esp + 0xbc], 4
mov ecx, dword [esp + 0xcc]
mov dword [eax + 0x48], ebx
mov dword [eax + 0x44], 0xffffffff
mov dword [eax + 0x4c], ecx
mov dword [eax + 0x50], esi
mov cl, byte [0x419704]
test cl, 0x10
je 0x407f3b
mov dword [eax + 0x40], esi
mov dword [eax + 0x3c], esi
jmp 0x407f41
mov dword [eax + 0x40], ebx
mov dword [eax + 0x3c], ebx
mov dword [esp + 0x2c], eax
push edi
xor edi, edi
mov dword [esp + 0x28], edi
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x90]
push edx
push eax
mov ecx, 0x419700
call fcn.00409340
mov dword [ebp + 8], ebx
mov ecx, dword [eax + 8]
cmp ecx, ebx
mov byte [esp + 0xc0], 6
jle 0x407f8b
mov eax, dword [eax + 0xc]
cmp eax, ebx
jne 0x407f81
mov eax, 0x4155ac
push ebx
push ecx
push eax
mov ecx, ebp
call fcn.00409ec0
push ebx
push ebx
mov ecx, ebp
call fcn.00409f80
lea ecx, [esp + 0x90]
mov esi, eax
mov byte [esp + 0xc0], 4
call fcn.00408e30
cmp esi, ebx
je 0x408595
push 0xffffffffffffffff
push 2
mov ecx, ebp
call fcn.00409f80
mov ebx, eax
sub ebx, edi
test ebx, ebx
jle 0x408067
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jl 0x408006
lea esi, [eax + eax]
cmp esi, 8
jge 0x407fe2
mov esi, 8
mov edx, dword [esp + 0x1c]
lea ecx, [esi*4]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], esi
jmp 0x40800a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [eax + ecx*4], edi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x408053
lea esi, [eax + eax]
cmp esi, 8
jge 0x40802f
mov esi, 8
mov eax, dword [esp + 0x1c]
lea edx, [esi*4]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], esi
jmp 0x408057
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [eax + ecx*4], ebx
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
push 0xffffffffffffffff
push 2
mov ecx, ebp
call fcn.00409f80
mov ebx, dword [esp + 0xd0]
mov esi, eax
mov dword [esp + 0x28], esi
mov edi, 2
movsx eax, byte [esi + ebx + 1]
add eax, 0xffffffdc
cmp eax, 0x57
ja case.0x40809d.39
xor edx, edx
mov dl, byte [eax + 0x408d2c]
jmp dword [edx*4 + 0x408d1c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jl 0x4080e5
lea esi, [eax + eax]
cmp esi, 8
jge 0x4080bd
mov esi, 8
mov ecx, dword [esp + 0x1c]
lea eax, [esi*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x30]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
jmp 0x4080e9
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [eax + edx*4], esi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x4084cc
lea esi, [eax + eax]
cmp esi, 8
jge 0x40849a
jmp 0x408495
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jl 0x408157
lea esi, [eax + eax]
cmp esi, 8
jge 0x40812f
mov esi, 8
mov ecx, dword [esp + 0x1c]
lea eax, [esi*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x30]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
jmp 0x40815b
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [eax + edx*4], 0xffffffff
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, eax
movsx ebx, byte [esi + ebx + 1]
jl 0x4081b7
lea esi, [eax + eax]
cmp esi, 8
jge 0x408189
mov esi, 8
mov ecx, dword [esp + 0x1c]
lea eax, [esi*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
add esp, 8
mov dword [eax + edx*4], ebx
jmp 0x408579
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [eax + edx*4], ebx
jmp 0x408579
push 0xffffffffffffffff
push 2
mov ecx, ebp
call fcn.00409f80
push 0xffffffffffffffff
push 3
mov ecx, ebp
mov esi, eax
call fcn.00409f80
mov edi, eax
mov eax, dword [esp + 0x28]
sub edi, esi
mov dword [esp + 0x70], 0x4155a4
lea ecx, [eax + ebx + 2]
lea edx, [edi - 3]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], edx
mov ebx, dword [esp + 0x38]
xor esi, esi
mov byte [esp + 0xc0], 7
mov eax, dword [ebx + 0x58]
test eax, eax
jle 0x408237
mov ecx, dword [ebx + 0x5c]
lea eax, [esp + 0x70]
push eax
mov edx, dword [ecx + esi*4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
add ecx, 0xc
call fcn.00409a50
test eax, eax
je 0x4082a1
mov eax, dword [ebx + 0x58]
inc esi
cmp esi, eax
jl 0x408213
mov dword [esp + 0x34], 0xfffffffd
mov eax, dword [esp + 0x34]
mov byte [esp + 0xc0], 4
test eax, eax
mov dword [esp + 0x70], 0x4155a4
jle 0x408328
cmp eax, dword [ebx + 8]
jg 0x408328
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jl 0x4082b5
lea esi, [eax + eax]
cmp esi, 8
jge 0x40827d
mov esi, 8
mov ecx, dword [esp + 0x1c]
lea eax, [esi*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], esi
jmp 0x4082b9
mov ecx, dword [ebx + 0x5c]
mov edx, dword [ecx + esi*4]
mov eax, dword [edx + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
mov dword [esp + 0x34], edx
jmp 0x40823f
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [eax + edx*4], 0xfffffffe
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x408314
lea esi, [eax + eax]
cmp esi, 8
jge 0x4082e2
mov esi, 8
mov ecx, dword [esp + 0x1c]
lea eax, [esi*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
add esp, 8
mov dword [eax + ecx*4], edx
jmp 0x408579
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x34]
mov dword [eax + ecx*4], edx
jmp 0x408579
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jl 0x408365
lea esi, [eax + eax]
cmp esi, 8
jge 0x408341
mov esi, 8
mov eax, dword [esp + 0x1c]
lea edx, [esi*4]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], esi
jmp 0x408369
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov dword [eax + edx*4], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x4083c0
lea esi, [eax + eax]
cmp esi, 8
jge 0x408392
mov esi, 8
mov ecx, dword [esp + 0x1c]
lea eax, [esi*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
add esp, 8
mov dword [eax + edx*4], edi
jmp 0x408579
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [eax + edx*4], edi
jmp 0x408579
mov eax, dword [esp + 0x28]
xor esi, esi
mov edi, 1
lea ecx, [eax + ebx]
mov al, byte [ecx + edi]
cmp al, 0x30
jl 0x4083f9
cmp al, 0x39
jg 0x4083f9
movsx eax, al
lea edx, [esi + esi*4]
inc edi
cmp edi, 3
lea esi, [eax + edx*2 - 0x30]
jle 0x4083de
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + 8]
cmp esi, ecx
jle 0x408427
mov eax, 0x66666667
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
dec edi
mov esi, edx
cmp esi, ecx
jg 0x408404
test esi, esi
jne 0x408427
mov edi, 1
jmp 0x408430
cmp edi, 1
jne 0x4084e0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jl 0x40846d
lea esi, [eax + eax]
cmp esi, 8
jge 0x408449
mov esi, 8
mov edx, dword [esp + 0x1c]
lea ecx, [esi*4]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], esi
jmp 0x408471
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
mov dword [eax + ecx*4], edx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x4084cc
lea esi, [eax + eax]
cmp esi, 8
jge 0x40849a
mov esi, 8
mov ecx, dword [esp + 0x1c]
lea eax, [esi*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
add esp, 8
mov dword [eax + edx*4], 1
jmp 0x408579
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [eax + edx*4], 1
jmp 0x408579
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jl 0x40851d
lea ebx, [eax + eax]
cmp ebx, 8
jge 0x4084f9
mov ebx, 8
mov ecx, dword [esp + 0x1c]
lea eax, [ebx*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebx
jmp 0x408521
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [eax + edx*4], 0xfffffffe
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc ecx
cmp ecx, eax
mov dword [esp + 0x18], ecx
jl 0x40856e
lea ebx, [eax + eax]
cmp ebx, 8
jge 0x40854a
mov ebx, 8
mov ecx, dword [esp + 0x1c]
lea eax, [ebx*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebx
jmp 0x408572
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [eax + edx*4], esi
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
add eax, edi
xor ebx, ebx
mov dword [esp + 0x28], eax
mov edi, eax
jmp 0x407f4c
mov ecx, dword [esp + 0xd4]
cmp edi, ecx
jge 0x408652
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
cmp edx, eax
jl 0x4085e8
lea esi, [eax + eax]
cmp esi, 8
jge 0x4085bd
mov esi, 8
mov ecx, dword [esp + 0x1c]
lea eax, [esi*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
mov ecx, dword [esp + 0xdc]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], esi
jmp 0x4085ec
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov dword [eax + edx*4], edi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
inc edx
cmp edx, eax
mov dword [esp + 0x18], edx
jl 0x40863c
lea esi, [eax + eax]
cmp esi, 8
jge 0x408611
mov esi, 8
mov ecx, dword [esp + 0x1c]
lea eax, [esi*4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_realloc]
mov ecx, dword [esp + 0xdc]
add esp, 8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], esi
jmp 0x408640
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
sub ecx, edi
mov dword [eax + edx*4], ecx
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax + 4]
and eax, 0x10
mov dword [esp + 0x54], eax
je 0x408677
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x5c], 0xfffffffe
add ecx, 0xfffffffe
mov dword [esp + 0x60], ecx
jmp 0x408683
mov edx, dword [esp + 0x18]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x5c], edx
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x40]
mov eax, edi
mov esi, edi
neg eax
sbb eax, eax
and al, 0xfc
add eax, 2
neg esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xcc]
sbb esi, esi
and esi, eax
neg edi
sbb edi, edi
xor ebx, ebx
not edi
and edi, eax
push ebx
push ebx
mov dword [esp + 0x74], edi
mov dword [esp + 0x60], ebx
mov dword [esp + 0x34], ebx
call fcn.00409fa0
mov dword [esp + 0x40], 0x4155a8
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], ebx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0xdc]
mov byte [esp + 0xc0], 8
cmp dword [ecx], 0
jne 0x4086ff
mov dword [esp + 0x30], 0
jmp 0x408797
mov ecx, dword [esp + 0x30]
xor edx, edx
cmp ecx, edx
jne 0x40873c
push 0x54
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [esp + 0x64], eax
test eax, eax
mov byte [esp + 0xc0], 9
je 0x40872c
mov ecx, eax
call fcn.00409950
jmp 0x40872e
xor eax, eax
mov edi, dword [esp + 0x6c]
mov byte [esp + 0xc0], 8
xor edx, edx
mov ecx, dword [esp + 0xc8]
cmp ebx, edx
mov dword [eax + 0x4c], ecx
mov ecx, dword [esp + 0xcc]
mov dword [eax + 0x48], edx
mov dword [eax + 0x44], 0xffffffff
mov dword [eax + 0x50], ecx
jge 0x408778
mov ebx, dword [esp + 0x38]
test byte [ebx + 4], 0x10
je 0x408770
mov dword [eax + 0x40], ecx
mov dword [eax + 0x3c], ecx
jmp 0x408793
mov dword [eax + 0x40], edx
mov dword [eax + 0x3c], edx
jmp 0x408793
cmp ebx, ecx
jle 0x40878d
mov edx, dword [esp + 0x38]
mov ebx, dword [edx + 4]
not ebx
shr ebx, 4
and ebx, 1
add ebx, ecx
mov dword [eax + 0x40], ebx
mov dword [eax + 0x3c], ebx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xe0]
mov ebx, esi
mov dword [esp + 0x34], 0
test eax, eax
jl 0x4087b6
cmp dword [esp + 0x34], eax
jge 0x408ae3
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x90]
push eax
push ecx
mov ecx, dword [esp + 0x40]
call fcn.00409340
mov dword [ebp + 8], 0
mov ecx, dword [eax + 8]
test ecx, ecx
mov byte [esp + 0xc0], 0xa
jle 0x4087f9
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4087ee
mov eax, 0x4155ac
push 0
push ecx
push eax
mov ecx, ebp
call fcn.00409ec0
lea ecx, [esp + 0x90]
mov byte [esp + 0xc0], 8
call fcn.00408e30
push 0
push 0
mov ecx, ebp
call fcn.00409f80
test eax, eax
je 0x408ae3
mov eax, dword [esp + 0x54]
push 0xffffffffffffffff
test eax, eax
je 0x4088b8
push 3
mov ecx, ebp
call fcn.00409f80
sub ebx, eax
mov edi, ebx
je 0x4088b2
push 0xffffffffffffffff
push 3
mov ecx, ebp
call fcn.00409f80
mov edx, dword [esp + 0xc8]
mov ecx, dword [esp + 0x48]
mov esi, eax
mov eax, dword [esp + 0x50]
add esi, edx
cmp ecx, eax
jl 0x408890
lea ebx, [eax + eax]
cmp ebx, 8
jge 0x40886c
mov ebx, 8
mov eax, dword [esp + 0x4c]
lea edx, [ebx*4]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], ebx
jmp 0x408894
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
push edi
mov dword [eax + ecx*4], esi
mov edx, dword [esp + 0x4c]
inc edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x4c], edx
call fcn.00409720
sub dword [esp + 0x2c], edi
push 0xffffffffffffffff
push 2
jmp 0x4088ec
push 2
mov ecx, ebp
call fcn.00409f80
mov esi, eax
sub esi, ebx
je 0x4088e8
mov edx, dword [esp + 0xc8]
lea ecx, [esp + 0x40]
add ebx, edx
push ebx
call fcn.00409720
push esi
lea ecx, [esp + 0x44]
call fcn.00409720
add dword [esp + 0x2c], esi
push 0xffffffffffffffff
push 3
mov ecx, ebp
call fcn.00409f80
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
mov edx, eax
cmp eax, ecx
mov dword [esp + 0x68], edx
je 0x408ac6
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + edx*4]
mov ebx, dword [ecx + edx*4 + 4]
mov ecx, dword [esp + 0xd0]
cmp eax, 0xffffffff
lea esi, [eax + ecx]
jne 0x408a48
movsx eax, bl
add eax, 0xffffffda
cmp eax, 0x3a
ja case.0x40894a.43
xor edx, edx
mov dl, byte [eax + 0x408d9c]
jmp dword [edx*4 + 0x408d84]
push 0xffffffffffffffff
push 2
mov ecx, ebp
call fcn.00409f80
mov esi, eax
mov eax, dword [esp + 0xc8]
push 0xffffffffffffffff
push 2
mov ecx, ebp
add esi, eax
call fcn.00409f80
push 0xffffffffffffffff
push 3
mov ecx, ebp
mov edi, eax
call fcn.00409f80
mov ebx, eax
sub ebx, edi
jmp case.0x40894a.43
mov esi, dword [esp + 0xc8]
push 0xffffffffffffffff
push 2
mov ecx, ebp
call fcn.00409f80
jmp 0x408a82
push 0xffffffffffffffff
push 3
mov ecx, ebp
call fcn.00409f80
mov ebx, dword [esp + 0xc8]
mov esi, eax
push 0xffffffffffffffff
push 3
mov ecx, ebp
add esi, ebx
call fcn.00409f80
mov ebx, dword [esp + 0xcc]
sub ebx, eax
jmp case.0x40894a.43
push 0
push 1
mov ecx, ebp
call fcn.00409f80
mov edi, eax
test edi, edi
jl 0x4089f9
lea esi, [edi + edi + 2]
push 0xffffffffffffffff
push esi
mov ecx, ebp
call fcn.00409f80
test eax, eax
jge 0x4089f9
dec edi
sub esi, 2
test edi, edi
jge 0x4089e3
lea ebx, [edi + edi + 2]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.00409f80
mov edx, dword [esp + 0xc8]
mov esi, eax
push 0xffffffffffffffff
push ebx
mov ecx, ebp
add esi, edx
call fcn.00409f80
mov dword [esp + 0x64], eax
lea eax, [edi + edi + 3]
push 0xffffffffffffffff
push eax
mov ecx, ebp
call fcn.00409f80
mov ebx, eax
mov eax, dword [esp + 0x64]
sub ebx, eax
jmp case.0x40894a.43
mov esi, dword [esp + 0xc8]
mov ebx, dword [esp + 0xcc]
jmp case.0x40894a.43
cmp eax, 0xfffffffe
jne case.0x40894a.43
lea edi, [ebx + ebx + 2]
push 0xffffffffffffffff
push edi
mov ecx, ebp
call fcn.00409f80
mov esi, eax
mov eax, dword [esp + 0xc8]
push 0xffffffffffffffff
push edi
mov ecx, ebp
add esi, eax
call fcn.00409f80
lea ecx, [ebx + ebx + 3]
push 0xffffffffffffffff
push ecx
mov ecx, ebp
mov edi, eax
call fcn.00409f80
sub eax, edi
mov ebx, eax
push esi
lea ecx, [esp + 0x44]
call fcn.00409720
push ebx
lea ecx, [esp + 0x44]
call fcn.00409720
mov eax, dword [esp + 0x54]
test eax, eax
je 0x408aa2
neg ebx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x5c]
add edx, ebx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x68]
add edx, ecx
cmp edx, eax
mov dword [esp + 0x68], edx
jne 0x408915
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x6c]
mov ebx, dword [esp + 0x28]
inc eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xe0]
jmp 0x4087a8
mov eax, dword [esp + 0x54]
test eax, eax
je 0x408b08
cmp edi, ebx
jge 0x408b2c
mov edx, dword [esp + 0xc8]
lea ecx, [esp + 0x40]
lea eax, [edi + edx]
push eax
call fcn.00409720
sub ebx, edi
push ebx
jmp 0x408b23
cmp ebx, edi
jge 0x408b2c
mov ecx, dword [esp + 0xc8]
lea edx, [ebx + ecx]
lea ecx, [esp + 0x40]
push edx
call fcn.00409720
sub edi, ebx
push edi
lea ecx, [esp + 0x44]
call fcn.00409720
mov eax, dword [esp + 0xe8]
test eax, eax
jne 0x408b44
mov eax, dword [esp + 0x30]
push eax
call fcn.004095e0
add esp, 4
mov ebx, dword [esp + 0xd8]
mov ecx, dword [esp + 0x48]
xor esi, esi
cmp ecx, esi
mov dword [ebx], esi
jle 0x408b6f
mov edx, dword [esp + 0x4c]
inc ecx
shr ecx, 1
lea eax, [edx + 4]
mov edx, dword [eax]
mov edi, dword [ebx]
add edi, edx
add eax, 8
dec ecx
mov dword [ebx], edi
jne 0x408b61
lea ecx, [esp + 0x7c]
call fcn.004097b0
mov eax, dword [ebx]
push esi
push eax
lea ecx, [esp + 0x84]
mov byte [esp + 0xc8], 0xb
call fcn.00409890
mov edi, dword [esp + 0x54]
mov dword [esp + 0x84], esi
cmp edi, esi
je 0x408bcc
mov ecx, dword [esp + 0x48]
lea esi, [ecx - 2]
test esi, esi
jl 0x408bfa
mov eax, dword [esp + 0x4c]
push 0
lea ecx, [esp + 0x80]
mov edx, dword [eax + esi*4 + 4]
mov eax, dword [eax + esi*4]
push edx
push eax
call fcn.004097d0
sub esi, 2
jns 0x408baa
jmp 0x408bfa
mov eax, dword [esp + 0x48]
test eax, eax
jle 0x408bfa
mov eax, dword [esp + 0x4c]
push 0
mov ecx, dword [eax + esi*4 + 4]
mov edx, dword [eax + esi*4]
push ecx
push edx
lea ecx, [esp + 0x88]
call fcn.004097d0
mov eax, dword [esp + 0x48]
add esi, 2
cmp esi, eax
jl 0x408bd4
push 0
lea eax, [esp + 0x43]
push 1
push eax
lea ecx, [esp + 0x88]
mov byte [esp + 0x4b], 0
call fcn.004097d0
mov ecx, dword [ebx]
push 3
lea edx, [esp + 0x28]
mov dword [esp + 0x28], ecx
push 1
push edx
mov ecx, ebp
call fcn.00409ec0
mov eax, dword [esp + 0x34]
push 0
lea ecx, [esp + 0x28]
push 1
push ecx
mov ecx, ebp
mov dword [esp + 0x30], eax
call fcn.00409ec0
test edi, edi
pop edi
je 0x408c7a
mov edx, dword [ebx]
mov esi, dword [esp + 0x28]
push 0
lea eax, [esp + 0x24]
sub edx, esi
push 1
push eax
mov ecx, ebp
mov dword [esp + 0x2c], edx
call fcn.00409ec0
mov ecx, dword [ebx]
mov esi, dword [esp + 0x54]
sub ecx, esi
push 0
lea edx, [esp + 0x24]
push 1
mov dword [esp + 0x28], ecx
push edx
jmp 0x408ca3
mov eax, dword [esp + 0x54]
push 0
lea ecx, [esp + 0x24]
push 1
push ecx
mov ecx, ebp
mov dword [esp + 0x2c], eax
call fcn.00409ec0
mov edx, dword [esp + 0x28]
push 0
lea eax, [esp + 0x24]
push 1
mov dword [esp + 0x28], edx
push eax
mov ecx, ebp
call fcn.00409ec0
lea ecx, [esp + 0x78]
call fcn.00409870
lea ecx, [esp + 0x78]
mov esi, eax
mov byte [esp + 0xbc], 8
call fcn.00409920
lea ecx, [esp + 0x3c]
mov byte [esp + 0xbc], 4
call fcn.00409780
lea ecx, [esp + 0xa0]
mov byte [esp + 0xbc], 0
call fcn.00408e30
lea ecx, [esp + 0xc]
mov dword [esp + 0xbc], 0xffffffff
call fcn.00408e30
mov eax, esi
pop esi
pop ebp
mov ecx, dword [esp + 0xac]
pop ebx
mov dword fs:[0], ecx
add esp, 0xb4
ret 0x24