Function at 0x4198f0
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x108
push ebx
push ebp
mov ebp, dword [esp + 0x114]
xor ebx, ebx
push esi
cmp bp, bx
push edi
mov esi, ecx
je case.0x41ec12.607
mov ecx, dword [esi]
mov edi, ebp
and edi, 0xffff
add ecx, 0x18fb50
push edi
push 0x48db04
mov dword [esp + 0x10c], edi
call fcn.00445f00
mov eax, edi
mov dword [esp + 0x10], ebx
cmp eax, 0x6a
jg 0x41e5c1
cmp eax, 0x64
jge 0x41e59a
dec eax
cmp eax, 0x45
ja case.0x41ec12.607
jmp dword [eax*4 + 0x41ee08]
lea ebp, [esi + 0x83618]
push ebx
push 0x48dae0
mov ecx, ebp
call fcn.00443c40
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0xb4]
rep stosd dword es:[edi], eax
mov dword [esp + 0x60], eax
mov eax, 0x10
mov word [esp + 0x72], ax
mov word [esp + 0x74], ax
mov eax, dword [esi]
mov word [esp + 0x22], 0x2e4
mov word [esp + 0x20], 0x1c
mov word [esp + 0x2c], bx
mov word [esp + 0x2e], 0x20
mov word [esp + 0x70], 0xa
mov word [esp + 0x76], 0x21
mov word [esp + 0x7e], 1
mov dword [esp + 0x64], 0x3f000000
mov dword [esp + 0xb4], ebx
mov ecx, dword [eax + 0x74fd68]
push ecx
push edx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x1e43b0
mov dword [esp + 0xb8], 0x48d2dc
push 0x48d3d0
mov byte [esp + 0x98], bl
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d3d0
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
call fcn.004425d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ax, word [esi + 0x7e]
cmp ax, word [esi + 0x7c]
jb 0x419a72
push 1
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
and eax, 0xffff
mov ecx, dword [esi + eax*4 + 0x3c]
push ecx
mov ecx, dword [esi]
add ecx, 0x1e43b0
call fcn.0044a580
lea edi, [esi + 0x83618]
push ebx
push 0x48dab8
mov ecx, edi
call fcn.00443c40
xor edx, edx
push 0xfffffc00
mov dx, word [esi + 0x7e]
push ebx
mov ecx, edi
mov eax, dword [esi + edx*4 + 0x5c]
push eax
call fcn.00442740
inc word [esi + 0x7e]
mov word [esi + 0x80], bx
mov byte [esi + 0x82], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push 0x3b
mov ecx, esi
mov byte [esi + 0x96], bl
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push ebx
push 0x48da94
lea ecx, [esi + 0x83618]
mov byte [esi + 0x96], 1
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
xor eax, eax
mov ax, word [esi + 0x3a]
sub eax, ebx
je 0x419b5a
dec eax
je 0x419b3e
dec eax
jne 0x419b60
push 8
mov ecx, esi
mov word [esi + 0x3a], bx
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push 8
mov ecx, esi
mov word [esi + 0x3a], 2
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov word [esi + 0x3a], 1
push 8
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi + 0xdc]
push ecx
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f930
mov ecx, dword [esi]
push eax
add ecx, 0x74fd6c
call fcn.00420530
test al, al
mov ecx, esi
je 0x419bc4
push 0x3b
call fcn.004198f0
push 8
lea ecx, [esi + 0x83618]
push 0x48da90
call fcn.00442c60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push 8
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push ebx
push 0x48da6c
lea ecx, [esi + 0x83618]
call fcn.00443c40
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.004203f0
push 0x3b
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
add esi, 0x83618
mov ecx, esi
call fcn.00442c20
push 1
push 0x48da48
mov ecx, esi
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push ebx
lea ecx, [esi + 0x83618]
push 0x48da6c
call fcn.00443c40
xor ebp, ebp
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [ebp + ebp*8]
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
lea eax, [edx*4 + 0xc8]
mov word [esp + 0x22], ax
mov eax, 0x10
push ebp
add ecx, 0x74fd6c
mov word [esp + 0x24], 0x200
mov word [esp + 0x30], ax
mov word [esp + 0x32], 0x20
mov dword [esp + 0x64], 0
mov word [esp + 0x74], 0xa
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x24
mov word [esp + 0x82], 1
mov dword [esp + 0x68], 0x3f800000
mov dword [esp + 0xb8], ebx
call fcn.00420060
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x1e43b0
mov dword [esp + 0xb8], 0x48d2dc
push 0x48d3d0
mov byte [esp + 0x98], bl
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d3d0
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov ecx, dword [esi]
mov word [esp + 0xe2], ax
add ecx, 0x74fd6c
call fcn.00420520
and eax, 0xffff
cmp eax, ebp
jne 0x419d74
mov ecx, dword [esi]
push 0x48da40
add ecx, 0x1e43b0
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48da40
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea edx, [esp + 0x20]
lea edi, [esi + 0x83618]
push edx
mov ecx, edi
call fcn.004425d0
mov ecx, dword [esi]
push ebp
add ecx, 0x74fd6c
call fcn.0041f940
push eax
lea eax, [esp + 0xb8]
push eax
call fcn.00439930
add esp, 8
lea ecx, [esp + 0x20]
mov word [esp + 0x2c], bx
mov word [esp + 0x20], 0xf8
push ecx
mov ecx, edi
mov word [esp + 0x7a], 0x21
call fcn.004425d0
inc ebp
cmp ebp, 0xa
jb 0x419c47
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
cmp byte [esi + 0x37], bl
jne case.0x41ec12.607
cmp byte [esi + 0x35], bl
jne case.0x41ec12.607
mov eax, dword [esi]
or byte [eax + 0x604], 4
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040f840
mov ebp, eax
lea edi, [esi + 0x210fb4]
cmp ebp, 5
push ebx
mov ecx, edi
jae 0x419e1a
push 0x48da18
jmp 0x419e1f
push 0x48d9f0
call fcn.00443c40
mov dl, byte [esi + 0x34]
push 1
mov ecx, esi
mov byte [esi + 0x35], 1
mov byte [esi + 0x36], dl
call fcn.00417de0
mov ecx, dword [esi]
push 1
call fcn.00437030
push 0x48d9e8
mov ecx, edi
call fcn.00442db0
mov ecx, dword [esi]
mov bx, ax
push 0x101
add ecx, 0x208870
and ebx, 0xffff
call fcn.004458e0
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x751b00
call fcn.0040f7f0
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439a70
mov ecx, dword [esi]
add esp, 8
add ecx, 0x208870
push 0x102
call fcn.004458e0
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00439b10
mov eax, dword [esp + 0x18]
add esp, 8
mov ecx, edi
push eax
push ebx
call fcn.00442cb0
lea ecx, [esp + 0x10]
push ecx
call fcn.00439990
add esp, 4
add ebp, 0x258
mov ecx, edi
push ebp
push 0x48da90
call fcn.00442c60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov dl, byte [esi + 0x36]
mov ecx, esi
push edx
mov byte [esi + 0x35], bl
call fcn.00417de0
push 0x35
mov ecx, esi
mov byte [esi + 0x37], 1
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov al, byte [esi + 0x36]
mov ecx, esi
push eax
mov byte [esi + 0x35], bl
call fcn.00417de0
mov al, byte [esi + 0x36]
mov ecx, dword [esi]
cmp al, bl
je 0x419f3d
push 1
call fcn.00437030
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push 2
call fcn.00437030
mov esi, dword [esi]
pop edi
xor word [esi + 0x604], 4
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040fa00
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439930
push 0x48d9dc
jmp 0x41edb9
push ebx
mov ecx, esi
call fcn.00417de0
mov eax, dword [esi]
pop edi
pop esi
pop ebp
mov byte [eax + 0x684], bl
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
push 0x48d2f0
add ecx, 0x2a6080
call fcn.0042a440
mov ecx, dword [esi]
mov edi, 1
mov word [ecx + 0x604], 3
mov edx, dword [esi]
mov word [esi + 0xc], bx
mov word [edx + 0x28ed66], di
mov ecx, dword [esi]
add ecx, 0x28ed80
call fcn.004240d0
push ebx
push 0x48d9b0
lea ecx, [esi + 0x83618]
mov dword [esi + 0x30], edi
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x28ed10
call fcn.004039d0
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041fbb0
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040f880
test al, al
mov ecx, esi
je 0x41a03f
push ebx
call fcn.00417de0
mov eax, dword [esi]
pop edi
pop esi
pop ebp
mov byte [eax + 0x684], bl
pop ebx
add esp, 0x108
ret 4
push 0x35
mov byte [esi + 0x37], 1
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push ebx
push 0x48d988
lea ecx, [esi + 0x83618]
call fcn.00443c40
push 0x124
push 0x142
mov ecx, esi
call fcn.00418bd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
push 1
add ecx, 0x74fd6c
call fcn.0041f960
test eax, eax
jne 0x41a0c9
mov ecx, dword [esi]
push 0x48d970
mov edx, dword [ecx + 0x2b0094]
push edx
call fcn.004398a0
add esp, 8
test al, al
je 0x41a0c9
push 0x30
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov eax, dword [esi]
mov ecx, dword [eax + 0x74fb44]
push ecx
lea ecx, [eax + 0x1e3d94]
call fcn.0043ef40
mov ecx, dword [esi]
xor eax, eax
mov ax, word [ecx + 0x28ed62]
add ecx, 0x1e3d94
lea edx, [eax + eax*4]
add edx, edx
push edx
call fcn.0043f370
mov ecx, dword [esi]
mov ax, word [ecx + 0x604]
test al, 4
je 0x41a110
xor eax, 4
mov word [ecx + 0x604], ax
push ebx
mov ecx, esi
call fcn.00417de0
mov ecx, dword [esi]
push 2
call fcn.00437030
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push ebx
push 0x48d94c
lea ecx, [esi + 0x83618]
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
push 2
add ecx, 0x74fef4
call fcn.00428990
mov ecx, dword [esi]
push 1
add ecx, 0x74fd6c
call fcn.0041f990
mov eax, dword [esi]
mov ecx, dword [eax + 0x74ff20]
push ecx
lea ecx, [eax + 0x74fd6c]
call fcn.0041fe90
mov eax, dword [esi]
mov dx, word [eax + 0x74ff20]
lea ecx, [eax + 0x28ed80]
push edx
call fcn.00423f80
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041fbb0
push 0x16
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x28ed10
call fcn.004039d0
push 1
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x28ed10
call fcn.004039d0
push 0xa
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea edi, [esi + 0x83618]
push 0x48d940
mov ecx, edi
call fcn.00442db0
and eax, 0xffff
mov ecx, edi
push eax
call fcn.004429d0
push 0x29
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea edi, [esi + 0x83618]
push 0x48d940
mov ecx, edi
call fcn.00442db0
and eax, 0xffff
mov ecx, edi
push eax
call fcn.00442a50
push 0x29
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea edi, [esi + 0x83618]
push 0x48d934
mov ecx, edi
call fcn.00442db0
and eax, 0xffff
mov ecx, edi
push eax
call fcn.004429d0
push 0x2a
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea edi, [esi + 0x83618]
push 0x48d934
mov ecx, edi
call fcn.00442db0
and eax, 0xffff
mov ecx, edi
push eax
call fcn.00442a50
push 0x2a
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x28ed10
call fcn.00403b80
push 0x2f
mov ecx, esi
call fcn.004198f0
push 0x22
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x28ed10
call fcn.00403bb0
push 0x2f
mov ecx, esi
call fcn.004198f0
push 0x22
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x28ed10
call fcn.00403bd0
mov ecx, dword [esi]
push eax
add ecx, 0x208870
call fcn.004455f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea edi, [esi + 0x83618]
push 0x48d940
mov ecx, edi
call fcn.00442db0
and eax, 0xffff
mov ecx, edi
push eax
call fcn.00442be0
mov ecx, dword [esi]
mov di, ax
and edi, 0xffff
add ecx, 0x18fb50
push edi
push 0x48d928
call fcn.00446020
mov ecx, dword [esi]
lea eax, [edi + edi*4]
add eax, eax
add ecx, 0x1e3d94
push eax
call fcn.0043f390
mov ecx, dword [esi]
push 0x3f800000
push ebx
add ecx, 0x1e3d94
call fcn.0043f3d0
mov ecx, dword [esi]
mov word [ecx + 0x28ed64], di
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea edi, [esi + 0x83618]
push 0x48d934
mov ecx, edi
call fcn.00442db0
and eax, 0xffff
mov ecx, edi
push eax
call fcn.00442be0
mov ecx, dword [esi]
mov di, ax
and edi, 0xffff
add ecx, 0x18fb50
push edi
push 0x48d928
call fcn.00446020
mov ecx, dword [esi]
lea edx, [edi + edi*4]
add edx, edx
add ecx, 0x1e3d94
and edx, 0xffff
push edx
call fcn.0043f370
mov ecx, dword [esi]
push 0x3f800000
push ebx
add ecx, 0x1e3d94
call fcn.0043f3d0
mov eax, dword [esi]
mov word [eax + 0x28ed62], di
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea edi, [esi + 0x83618]
push ebx
push 0x48d904
mov ecx, edi
call fcn.00443c40
mov cx, word [esi + 0x12]
push ecx
push 0x48da90
mov ecx, edi
call fcn.00442c60
mov dx, word [esi + 0x12]
mov ecx, edi
push edx
call fcn.00442c50
push 0x48d8fc
mov ecx, edi
call fcn.00442db0
mov ecx, dword [esi]
mov bx, ax
add ecx, 0x18fb60
and ebx, 0xffff
call fcn.0043ddb0
mov ecx, dword [esi]
add ecx, 0x208870
test al, al
je 0x41a4a6
push 0x43
jmp 0x41a4a8
push 0x44
call fcn.004458e0
push eax
mov ecx, edi
push ebx
call fcn.00442cb0
push 0x48d934
mov ecx, edi
call fcn.00442db0
mov ecx, dword [esi]
and eax, 0xffff
mov dx, word [ecx + 0x28ed62]
mov ecx, edi
push edx
push eax
call fcn.00442ab0
push 0x48d940
mov ecx, edi
call fcn.00442db0
mov ecx, dword [esi]
and eax, 0xffff
mov dx, word [ecx + 0x28ed64]
mov ecx, edi
push edx
push eax
call fcn.00442ab0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x18fb60
call fcn.0043ddb0
mov ecx, dword [esi]
push eax
push 0x20
push 0x300
push 0x400
add ecx, 0x18fb60
call fcn.0043d6a0
mov ecx, dword [esi]
add ecx, 0x18fb60
call fcn.0043db90
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
mov ecx, dword [esi]
add ecx, 0x18fb60
call fcn.0043ddb0
mov ecx, dword [esi]
mov byte [ecx + 0x28ed77], al
mov ecx, dword [esi]
add ecx, 0x28ed10
call fcn.004039d0
push 0x22
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041ff30
test al, al
je 0x419b60
push ebx
push 0x48d8d8
lea ecx, [esi + 0x83618]
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov edx, dword [esi]
mov eax, dword [edx + 0x18fb4c]
push eax
call fcn.00439900
add esp, 4
cmp ax, 1
jbe 0x41a5f1
mov ecx, dword [esi]
lea eax, [esp + 0x10]
mov edx, dword [ecx + 0x18fb4c]
push edx
push eax
call fcn.00439930
lea ecx, [esp + 0x18]
push 0x48d8d0
push ecx
call fcn.00439b10
add esp, 0x10
jmp 0x41a603
lea edx, [esp + 0x10]
push 0x48d8c4
push edx
call fcn.00439930
add esp, 8
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f930
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439b10
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
mov ecx, dword [esi]
add ecx, 0x2a6080
call fcn.0042a440
lea edx, [esp + 0x10]
push edx
call fcn.00439990
mov eax, dword [esi]
add esp, 4
mov word [eax + 0x604], 2
mov ecx, dword [esi]
add ecx, 0x74fd6c
mov word [esi + 0xc], bx
call fcn.0041f8b0
mov ecx, dword [esi]
mov dword [esi + 0xdc], eax
push 2
mov word [ecx + 0x28ed66], bx
mov ecx, dword [esi]
call fcn.00437030
mov edx, dword [esi + 0xdc]
mov ecx, dword [esi]
push edx
push 1
add ecx, 0x37cfc4
call fcn.00410f20
push ebx
mov ecx, esi
call fcn.00417de0
mov eax, dword [esi]
mov ecx, dword [eax + 0x74fb44]
push ecx
lea ecx, [eax + 0x1e3d94]
call fcn.0043ef40
mov esi, dword [esi]
xor eax, eax
mov ax, word [esi + 0x28ed62]
lea ecx, [esi + 0x1e3d94]
lea edx, [eax + eax*4]
add edx, edx
push edx
call fcn.0043f370
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push ebx
push 0x48d89c
lea ecx, [esi + 0x83618]
call fcn.00443c40
mov eax, dword [esi]
mov word [esi + 0xc], bx
mov word [eax + 0x604], 2
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8b0
mov ecx, dword [esi]
mov dword [esi + 0xdc], eax
pop edi
pop esi
mov word [ecx + 0x28ed66], bx
pop ebp
pop ebx
add esp, 0x108
ret 4
mov edx, dword [esi]
mov eax, dword [edx + 0x18fb4c]
push eax
call fcn.00439900
add esp, 4
cmp ax, 1
jbe 0x41a753
mov ecx, dword [esi]
lea eax, [esp + 0x10]
mov edx, dword [ecx + 0x18fb4c]
push edx
push eax
call fcn.00439930
lea ecx, [esp + 0x18]
push 0x48d8d0
push ecx
call fcn.00439b10
add esp, 0x10
jmp 0x41a765
lea edx, [esp + 0x10]
push 0x48d8c4
push edx
call fcn.00439930
add esp, 8
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f930
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439b10
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
call dword [sym.imp.kernel32.dll_DeleteFileA]
lea edx, [esp + 0x10]
push edx
call fcn.00439990
add esp, 4
mov ecx, esi
push 8
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push 1
push 0x498e60
push 0x498e60
push 0x48d884
push 0x48d87c
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov eax, dword [esi]
pop edi
pop esi
pop ebp
mov byte [eax + 0x684], bl
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040fa00
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439930
push 0x48d86c
jmp 0x41edb9
push ebx
push 0x48d848
lea ecx, [esi + 0x83618]
call fcn.00443c40
mov eax, dword [esi + 0xd8]
mov ecx, dword [esi]
push eax
add ecx, 0x74fd6c
call fcn.0041f9c0
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041fbb0
mov ecx, 9
xor eax, eax
lea edi, [esi + 0x98]
mov byte [esi + 0xe0], 1
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xdc]
mov ecx, dword [esi + 0xd8]
push ebx
add ecx, eax
push ebx
push 0x28
mov dword [esi + 0xdc], ecx
push 0xc4
push 0x10e
mov ecx, esi
mov dword [esi + 0xb8], eax
call fcn.00418860
mov eax, dword [esi + 0xbc]
mov edi, 0xe8
cmp eax, ebx
je 0x41a89e
push ebx
push ebx
push 0x29
push edi
push 0x12e
mov ecx, esi
call fcn.00418860
mov edi, 0x10c
cmp dword [esi + 0xc0], ebx
je 0x41a8ba
push ebx
push ebx
push 0x2a
push edi
push 0x12e
mov ecx, esi
call fcn.00418860
add edi, 0x24
cmp dword [esi + 0xc4], ebx
je 0x41a8d6
push ebx
push ebx
push 0x2b
push edi
push 0x12e
mov ecx, esi
call fcn.00418860
add edi, 0x24
cmp dword [esi + 0xc8], ebx
je 0x41a8f2
push ebx
push ebx
push 0x2c
push edi
push 0x12e
mov ecx, esi
call fcn.00418860
add edi, 0x24
cmp dword [esi + 0xcc], ebx
je 0x41a90e
push ebx
push ebx
push 0x2d
push edi
push 0x12e
mov ecx, esi
call fcn.00418860
add edi, 0x24
cmp dword [esi + 0xd0], ebx
jne 0x41a91e
cmp dword [esi + 0xd4], ebx
je 0x41a935
push ebx
add edi, 0xc
push ebx
push 0x31
push edi
push 0x10e
mov ecx, esi
call fcn.00418860
add edi, 0x24
cmp dword [esi + 0xd0], ebx
je 0x41a951
push ebx
push ebx
push 0x32
push edi
push 0x12e
mov ecx, esi
call fcn.00418860
add edi, 0x24
cmp dword [esi + 0xd4], ebx
je 0x41a96d
push ebx
push ebx
push 0x33
push edi
push 0x12e
mov ecx, esi
call fcn.00418860
add edi, 0x24
mov dx, word [esi + 0xb8]
push ebx
push edx
add edi, 0xc
push 0x35
push edi
push 0x10e
mov ecx, esi
call fcn.00418860
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x2019ec
call fcn.004498a0
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413720
test ax, ax
jne 0x41a9ff
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413710
cmp ax, 0xc
jne 0x41a9ff
mov eax, dword [esi + 0xdc]
mov ecx, dword [esi]
push eax
add ecx, 0x74fd6c
call fcn.0041f930
mov ecx, dword [esi]
push eax
add ecx, 0x74fd6c
call fcn.00420530
push 0x41
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413720
cmp ax, 4
jae 0x41aa60
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413710
cmp ax, 0xc
jae 0x41aa60
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413720
mov ecx, dword [esi]
inc eax
push eax
add ecx, 0x7491d8
call fcn.00413710
mov ecx, dword [esi]
push eax
add ecx, 0x74fd6c
call fcn.0041fe30
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413720
inc eax
push eax
jmp 0x41aac2
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413710
mov ecx, dword [esi]
mov di, ax
add ecx, 0x74fd6c
call fcn.0041f8c0
cmp ax, di
jne 0x41aa88
mov word [esi + 0x38], 0x80
mov ecx, dword [esi]
push ebx
add ecx, 0x7491d8
call fcn.00413710
mov ecx, dword [esi]
inc eax
push eax
add ecx, 0x74fd6c
call fcn.0041fe30
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413710
mov ecx, dword [esi]
inc eax
push eax
add ecx, 0x7491d8
call fcn.004136d0
push ebx
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.004136e0
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041fbb0
mov eax, dword [esi]
cmp dword [eax + 0x2b0090], ebx
je 0x41ab54
push ebx
mov ecx, esi
mov word [eax + 0x604], 2
call fcn.00417de0
mov ecx, dword [esi]
push 2
call fcn.00437030
mov ecx, dword [esi]
call fcn.004348b0
mov ecx, dword [esi]
mov edx, dword [ecx + 0x2b0090]
push edx
call fcn.00435420
mov ecx, dword [esi]
call fcn.004349c0
mov ecx, 9
xor eax, eax
lea edi, [esi + 0xbc]
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8b0
push 0x15
mov ecx, esi
mov dword [esi + 0xdc], eax
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push 1
push 0x12
lea ecx, [eax + 0x37cfc4]
call fcn.00410f20
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041fbb0
push 0x17
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push ebx
push 0x48d824
lea ecx, [esi + 0x83618]
call fcn.00443c40
mov esi, dword [esi]
mov eax, dword [esi + 0x74fb48]
lea ecx, [esi + 0x1e3d94]
push eax
call fcn.0043ef40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push 8
mov ecx, esi
call fcn.004198f0
mov esi, dword [esi]
mov ecx, dword [esi + 0x74fb48]
push ecx
lea ecx, [esi + 0x1e3d94]
call fcn.0043ef40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
push 1
add ecx, 0x74fd6c
call fcn.0041f9c0
push ebx
push 0x48d804
lea ecx, [esi + 0x83618]
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8b0
test eax, eax
jne 0x41ac36
push 0x3e
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push ebx
push 0x48d7e0
lea ecx, [esi + 0x83618]
call fcn.00443c40
push 0x2e
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
cmp word [eax + 0x2b4a06], bx
jbe 0x41b200
mov ecx, pe_nt_image_headers32
mov edx, 0xd
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], cx
xor ecx, ecx
mov word [esp + 0x22], 5
mov word [esp + 0x20], 0x200
mov word [esp + 0x28], dx
mov cx, word [eax + 0x2b4a06]
mov edi, 3
dec ecx
je 0x41acc7
dec ecx
je 0x41acc0
dec ecx
jne 0x41acd1
mov word [esp + 0x2a], 4
jmp 0x41acd1
mov word [esp + 0x22], dx
jmp 0x41accc
mov word [esp + 0x22], bx
mov word [esp + 0x2a], di
mov ecx, 8
push 0x48d7d8
mov word [esp + 0x76], cx
mov word [esp + 0x78], cx
lea ecx, [eax + 0x1e43b0]
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 1
mov word [esp + 0x7a], 0xc
mov dword [esp + 0xbc], 0x48d7d0
mov word [esp + 0x82], 9
mov byte [esp + 0x98], 0x11
mov byte [esp + 0x99], 0x21
mov byte [esp + 0x9a], 0x18
mov byte [esp + 0x9b], 0x1a
mov byte [esp + 0x9c], 0x10
mov byte [esp + 0x9d], 0x12
mov byte [esp + 0x9e], 0x20
mov byte [esp + 0x9f], 0x22
mov byte [esp + 0xa0], 0x19
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d7d8
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea ebp, [esi + 0x83618]
lea edx, [esp + 0x20]
push edx
mov ecx, ebp
mov word [esp + 0xe6], ax
call fcn.004425d0
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push 0x27
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
mov dword [esp + 0x64], eax
mov eax, 0x10
add ecx, 0x208870
mov word [esp + 0x26], 0x3c
mov word [esp + 0x24], 0x200
mov word [esp + 0x30], bx
mov word [esp + 0x32], 0x1c
mov dword [esp + 0x68], 0x3f800000
mov word [esp + 0x74], 0xa
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x24
mov word [esp + 0x82], 1
call fcn.004458e0
mov ecx, dword [esi]
push 0x48d7c4
add ecx, 0x1e43b0
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x48d2dc
mov byte [esp + 0x98], bl
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d7c4
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
call fcn.004425d0
mov edx, dword [esi]
mov ebp, 0x5f
mov ax, word [edx + 0x2b4a06]
cmp ax, 1
jne 0x41ae96
mov ebp, 0x6f
cmp ax, bx
mov dword [esp + 0x100], ebx
jbe 0x41b200
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push 0x48cc18
rep stosd dword es:[edi], eax
mov eax, 0x30
lea ecx, [edx + 0x1e43b0]
mov word [esp + 0x30], ax
mov word [esp + 0x32], ax
mov eax, 8
mov word [esp + 0x26], bp
mov word [esp + 0x24], 0xc8
mov dword [esp + 0x64], 0
mov word [esp + 0x74], 3
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x21
mov word [esp + 0x82], 1
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d2dc
mov byte [esp + 0x98], 0x1f
mov byte [esp + 0x99], bl
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48cc18
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov edx, dword [esp + 0x100]
mov ecx, dword [esi]
mov word [esp + 0xe2], ax
and edx, 0xffff
xor eax, eax
mov ax, word [ecx + edx*2 + 0x2b4a08]
lea edi, [eax - 0x42]
cmp edi, 0x18
ja case.0x41af8d.76
xor eax, eax
mov al, byte [edi + 0x41ef4c]
jmp dword [eax*4 + 0x41ef20]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x3e400000
mov dword [esp + 0x38], 0x3ee00000
mov dword [esp + 0x3c], 0x3f200000
push 0x45
jmp 0x41b0e9
mov dword [esp + 0x38], 0x3ee00000
mov dword [esp + 0x3c], 0x3f200000
push 0x46
jmp 0x41b0d9
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x3e400000
mov dword [esp + 0x38], 0x3e800000
mov dword [esp + 0x3c], 0x3ee00000
push 0x47
jmp 0x41b0e9
mov dword [esp + 0x30], 0x3e400000
mov dword [esp + 0x34], 0x3ec00000
mov dword [esp + 0x38], 0x3f200000
mov dword [esp + 0x3c], 0x3f500000
push 0x48
jmp 0x41b0e9
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x3e400000
mov dword [esp + 0x38], 0x3f200000
mov dword [esp + 0x3c], 0x3f500000
push 0x49
jmp 0x41b0e9
mov dword [esp + 0x30], 0x3e400000
mov dword [esp + 0x34], 0x3ec00000
mov dword [esp + 0x38], 0x3d800000
mov dword [esp + 0x3c], 0x3e800000
push 0x4a
jmp 0x41b0e9
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x3e400000
mov dword [esp + 0x38], 0x3f500000
mov dword [esp + 0x3c], 0x3f800000
push 0x4b
jmp 0x41b0e9
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0x3e400000
mov dword [esp + 0x38], 0x3d800000
mov dword [esp + 0x3c], 0x3e800000
push 0x4c
jmp 0x41b0e9
mov dword [esp + 0x38], 0x3e800000
mov dword [esp + 0x3c], 0x3ee00000
push 0x4d
jmp 0x41b0d9
mov dword [esp + 0x38], 0x3f200000
mov dword [esp + 0x3c], 0x3f500000
push 0x4e
mov dword [esp + 0x34], 0x3f400000
mov dword [esp + 0x38], 0x3f700000
add ecx, 0x208870
call fcn.004458e0
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
jne 0x41b106
mov dword [esp + 0x10], 0x48d7ac
lea ecx, [esp + 0x20]
mov byte [esp + 0x69], 1
push ecx
lea ecx, [esi + 0x83618]
call fcn.004425d0
mov edx, dword [esp + 0x10]
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
mov dword [esp + 0x60], eax
mov eax, 0x10
push 0x48d3d0
add ecx, 0x1e43b0
mov word [esp + 0x26], bp
mov word [esp + 0x24], 0x124
mov word [esp + 0x30], bx
mov word [esp + 0x32], 0x20
mov dword [esp + 0x68], 0x3f800000
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 0xa
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x21
mov word [esp + 0x82], bx
mov dword [esp + 0xb8], edx
mov dword [esp + 0xbc], 0x48d3c8
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d3d0
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea eax, [esp + 0x20]
push eax
lea ecx, [esi + 0x83618]
call fcn.004425d0
mov eax, dword [esp + 0x100]
mov edx, dword [esi]
add ebp, 0x31
inc eax
cmp ax, word [edx + 0x2b4a06]
mov dword [esp + 0x100], eax
jb 0x41aea6
push 0x199
push 0x142
mov ecx, esi
mov dword [esp + 0x18], ebx
call fcn.00418bd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f900
mov ecx, dword [esi]
push eax
add ecx, 0x74fef4
call fcn.00429160
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8e0
mov ecx, dword [esi]
push eax
add ecx, 0x74fef4
call fcn.00428990
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041fbb0
push 1
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push ebx
push 0x48d78c
lea ecx, [esi + 0x83618]
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
mov edx, dword [ecx + 0x18fb4c]
push edx
call fcn.00439900
add esp, 4
cmp ax, 1
jbe 0x41b2d7
mov eax, dword [esi]
lea edx, [esp + 0x10]
mov ecx, dword [eax + 0x18fb4c]
push ecx
push edx
call fcn.00439930
lea eax, [esp + 0x18]
push 0x48d8d0
push eax
call fcn.00439b10
add esp, 0x10
jmp 0x41b2e9
lea ecx, [esp + 0x10]
push 0x48d8c4
push ecx
call fcn.00439930
add esp, 8
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f930
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00439b10
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
add esp, 8
add ecx, 0x2a6080
push eax
call fcn.0042b0a0
lea ecx, [esp + 0x10]
push ecx
call fcn.00439990
mov edx, dword [esi]
add esp, 4
mov word [edx + 0x604], 1
mov ecx, dword [esi]
add ecx, 0x28ed80
call fcn.004240d0
mov eax, dword [esi]
mov ecx, dword [eax + 0x74fb48]
push ecx
lea ecx, [eax + 0x1e3d94]
call fcn.0043ef40
mov ecx, dword [esi]
xor eax, eax
mov ax, word [ecx + 0x28ed62]
add ecx, 0x1e3d94
lea edx, [eax + eax*4]
add edx, edx
push edx
call fcn.0043f370
push 1
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
mov ax, word [ecx + 0x604]
test al, 4
je 0x41b398
xor eax, 4
mov word [ecx + 0x604], ax
push ebx
mov ecx, esi
call fcn.00417de0
mov ecx, dword [esi]
push 2
call fcn.00437030
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea edi, [esi + 0x83618]
push 0x1b
mov ecx, edi
mov word [esi + 0x12], 0x32
call fcn.00443bf0
push 1
mov ecx, esi
call fcn.00417de0
push ebx
push 0x48d76c
mov ecx, edi
call fcn.00443c40
mov ecx, dword [esi]
push ebx
call fcn.00437030
mov esi, dword [esi]
pop edi
or byte [esi + 0x604], 4
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413710
mov ecx, dword [esi]
and eax, 0xffff
push eax
push 0x48d744
add ecx, 0x18fb50
call fcn.00445f00
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040f880
test al, al
jne 0x41b470
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413710
cmp ax, 2
jbe 0x41b470
add esi, 0x83618
mov ecx, esi
call fcn.00442c20
push 1
push 0x48d720
mov ecx, esi
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
mov word [esi + 0xc], bx
call fcn.00434920
mov eax, dword [esi]
push ebx
mov ecx, esi
mov word [eax + 0x604], 2
call fcn.00417de0
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.004137b0
mov ecx, dword [esi]
push eax
call fcn.00435420
mov ecx, 9
xor eax, eax
lea edi, [esi + 0xbc]
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8b0
mov dword [esi + 0xdc], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
mov byte [ecx + 0x74ff1c], bl
mov eax, dword [esi]
mov edx, dword [eax + 0x74ff24]
lea ecx, [eax + 0x74fd6c]
push edx
call fcn.0041feb0
mov eax, dword [esi]
mov ecx, dword [eax + 0x74ff20]
push ecx
lea ecx, [eax + 0x74fd6c]
call fcn.0041fe90
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041fbb0
mov eax, dword [esi]
mov dx, word [eax + 0x74ff20]
lea ecx, [eax + 0x28ed80]
push edx
call fcn.00423f80
mov eax, dword [esi]
mov ecx, dword [eax + 0x74ff24]
push ecx
lea ecx, [eax + 0x28ed80]
call fcn.00423d80
push 0x16
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041fbb0
push ebx
lea ecx, [esi + 0x83618]
push 0x48d700
call fcn.00443c40
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push 0x48d3d0
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
mov dword [esp + 0x64], eax
mov eax, 0x10
add ecx, 0x1e43b0
mov word [esp + 0x26], 0x2bc
mov word [esp + 0x24], 0x200
mov word [esp + 0x30], bx
mov word [esp + 0x32], 0x20
mov word [esp + 0x74], 9
mov dword [esp + 0x68], 0x3f800000
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x24
mov word [esp + 0x82], 1
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d6f8
mov byte [esp + 0x98], bl
mov word [esp + 0x7e], 0x1f4
mov word [esp + 0x80], 0x3d
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d3d0
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov word [esp + 0xe2], ax
xor eax, eax
mov ax, word [esi + 0x3a]
sub eax, ebx
je 0x41b67e
dec eax
je 0x41b661
dec eax
jne 0x41b6a1
mov ecx, dword [esi]
push 0x10f
add ecx, 0x208870
call fcn.004458e0
lea edx, [esp + 0xb4]
push eax
push edx
jmp 0x41b699
mov ecx, dword [esi]
push 0x10e
add ecx, 0x208870
call fcn.004458e0
push eax
lea eax, [esp + 0xb8]
push eax
jmp 0x41b699
mov ecx, dword [esi]
push 0x10d
add ecx, 0x208870
call fcn.004458e0
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.00439930
add esp, 8
lea edx, [esp + 0x20]
lea ebp, [esi + 0x83618]
push edx
mov ecx, ebp
call fcn.004425d0
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x22]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413710
mov ecx, dword [esi]
push eax
add ecx, 0x7491d8
call fcn.00413850
mov ecx, dword [esi]
mov eax, 0xc0
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov eax, 4
push 0x48ccb4
add ecx, 0x1e43b0
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 3
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x24
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0x3f800000
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0x3f800000
mov byte [esp + 0x6d], 1
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x80], bx
mov word [esp + 0x82], 1
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d6f4
mov byte [esp + 0x98], 1
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48ccb4
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
mov word [esp + 0xe6], ax
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0x3d0efa35
call fcn.004425d0
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0xbd0efa35
call fcn.004425d0
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x22]
push ecx
mov ecx, dword [esi]
push edx
add ecx, 0x7491d8
call fcn.00413710
mov ecx, dword [esi]
push eax
add ecx, 0x7491d8
call fcn.00413850
mov ecx, dword [esi]
mov eax, 0x60
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov eax, 4
push 0x48d6ec
add ecx, 0x1e43b0
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 3
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x24
mov dword [esp + 0x34], 0x3f500000
mov dword [esp + 0x38], 0x3f800000
mov dword [esp + 0x3c], 0x3f500000
mov dword [esp + 0x40], 0x3f800000
mov byte [esp + 0x6d], 1
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x80], bx
mov word [esp + 0x82], 1
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d6f4
mov byte [esp + 0x98], 1
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
call fcn.004425d0
mov ecx, dword [esi]
xor ebp, ebp
add ecx, 0x7491d8
call fcn.004136c0
test ax, ax
jbe 0x41bb19
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8c0
and eax, 0xffff
cmp ebp, eax
ja 0x41bb19
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x22]
push ecx
mov ecx, dword [esi]
push edx
push ebp
add ecx, 0x7491d8
call fcn.00413850
mov ecx, dword [esi]
mov eax, pe_nt_image_headers32
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov eax, 4
add ecx, 0x74fd6c
mov dword [esp + 0x60], 0
mov word [esp + 0x70], 2
mov word [esp + 0x72], ax
mov word [esp + 0x74], ax
mov word [esp + 0x76], 0x24
mov dword [esp + 0x30], 0x3f100000
mov dword [esp + 0x34], 0x3f300000
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0x3e000000
mov byte [esp + 0x69], 1
mov dword [esp + 0x50], 0x3f100000
mov dword [esp + 0x54], 0x3f300000
mov dword [esp + 0x58], 0x3e000000
mov dword [esp + 0x5c], 0x3e800000
call fcn.0041f8c0
and eax, 0xffff
cmp ebp, eax
jae 0x41ba33
fld dword [esp + 0x38]
fadd dword [0x485248]
fstp dword [esp + 0x38]
fld dword [esp + 0x3c]
fadd dword [0x485248]
fstp dword [esp + 0x3c]
fld dword [esp + 0x58]
fadd dword [0x485248]
fstp dword [esp + 0x58]
fld dword [esp + 0x5c]
fadd dword [0x485248]
fstp dword [esp + 0x5c]
lea ecx, [esp + 0xb8]
lea eax, [ebp + 0xc8]
push 0x48d6e4
push ecx
mov byte [esp + 0x72], 1
mov word [esp + 0x80], bx
mov word [esp + 0x82], 0x1f4
mov word [esp + 0x84], ax
mov word [esp + 0x86], 1
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
call fcn.00439930
lea edx, [esp + 0xc0]
push ebp
push edx
call fcn.00439a70
mov ecx, dword [esi]
add esp, 0x10
add ecx, 0x1e43b0
mov byte [esp + 0x94], bl
push 0x48d6ec
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea eax, [esp + 0x20]
push eax
lea ecx, [esi + 0x83618]
call fcn.004425d0
lea ecx, [esp + 0xb8]
push ecx
call fcn.00439990
mov ecx, dword [esi]
add esp, 4
add ecx, 0x7491d8
inc ebp
call fcn.004136c0
and eax, 0xffff
cmp ebp, eax
jb 0x41b92d
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.00413710
mov bp, ax
and ebp, 0xffff
mov dword [esp + 0x14], ebp
jbe 0x41bc7a
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.004137e0
mov edx, eax
lea ecx, [ebp + 0xc7]
shl edx, 6
add edx, eax
mov eax, 0x1bf
sub eax, edx
mov word [esp + 0x7c], cx
mov ecx, dword [esi]
mov word [esp + 0x20], ax
mov eax, pe_nt_image_headers32
push 0x48d6ec
mov word [esp + 0x30], ax
mov word [esp + 0x32], ax
mov eax, 4
add ecx, 0x1e43b0
mov word [esp + 0x26], 0x60
mov dword [esp + 0x64], 0
mov word [esp + 0x74], 2
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x24
mov dword [esp + 0x34], 0x3f600000
mov dword [esp + 0x38], 0x3f800000
mov dword [esp + 0x3c], 0x3e800000
mov dword [esp + 0x40], 0x3ec00000
mov byte [esp + 0x6d], 1
mov dword [esp + 0x54], 0x3f600000
mov dword [esp + 0x58], 0x3f800000
mov dword [esp + 0x5c], 0x3ec00000
mov dword [esp + 0x60], 0x3f000000
mov byte [esp + 0x6e], 1
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], 0x1f4
mov word [esp + 0x82], 1
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d6d8
mov byte [esp + 0x98], bl
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea edx, [esp + 0x20]
lea ecx, [esi + 0x83618]
push edx
mov word [esp + 0xe6], ax
call fcn.004425d0
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8c0
and eax, 0xffff
cmp ebp, eax
jae 0x41bdd8
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
add ecx, 0x7491d8
call fcn.004137e0
mov ecx, eax
mov edx, 0x4cb
shl ecx, 6
add ecx, eax
mov eax, pe_nt_image_headers32
sub edx, ecx
mov ecx, dword [esi]
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov eax, 4
add ebp, 0xc9
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0x24], dx
mov word [esp + 0x26], 0x60
mov dword [esp + 0x64], 0
mov word [esp + 0x74], 2
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x24
mov dword [esp + 0x34], 0x3f600000
mov dword [esp + 0x38], 0x3f800000
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0x3e000000
mov byte [esp + 0x6d], 1
mov dword [esp + 0x54], 0x3f600000
mov dword [esp + 0x58], 0x3f800000
mov dword [esp + 0x5c], 0x3e000000
mov dword [esp + 0x60], 0x3e800000
mov byte [esp + 0x6e], 1
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], 0x1f4
mov word [esp + 0x80], bp
mov word [esp + 0x82], 1
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d6cc
mov byte [esp + 0x98], bl
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea eax, [esp + 0x20]
push eax
lea ecx, [esi + 0x83618]
call fcn.004425d0
mov edi, dword [esp + 0x14]
mov ecx, dword [esi]
push edi
add ecx, 0x7491d8
xor ebp, ebp
call fcn.004137e0
test ax, ax
jbe case.0x41ec12.607
mov dword [esp + 0x104], edi
mov dword [esp + 0x108], ebx
fild qword [esp + 0x104]
fld dword [0x485504]
fmul st(1)
fadd dword [0x485500]
fstp dword [esp + 0x10c]
fadd dword [0x4851d8]
fmul dword [0x485504]
fstp dword [esp + 0x104]
jmp 0x41be38
mov edi, dword [esp + 0x14]
mov ecx, dword [esi]
push edi
add ecx, 0x7491d8
call fcn.004137e0
mov ecx, dword [esi]
mov dword [esp + 0x100], eax
add ecx, 0x7491d8
call fcn.00413720
and eax, 0xffff
cmp ebp, eax
jne 0x41c202
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push 0x119
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
mov dword [esp + 0x64], eax
mov eax, 0x10
add ecx, 0x208870
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
lea eax, [ebp + 0xe1]
mov word [esp + 0x26], 0xf
mov word [esp + 0x24], 0x200
mov word [esp + 0x30], bx
mov word [esp + 0x32], 1
mov word [esp + 0x74], 0xa
mov dword [esp + 0x68], 0x3f800000
mov word [esp + 0x7a], 0x24
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x80], ax
mov word [esp + 0x82], bx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
call fcn.004458e0
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.00439930
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xbc]
lea edx, [edi + 1]
push edx
push eax
call fcn.00439a70
mov ecx, dword [esi]
add esp, 0x10
add ecx, 0x208870
push 0x11a
call fcn.004458e0
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.00439b10
lea edx, [ebp + 1]
lea eax, [esp + 0xbc]
push edx
push eax
call fcn.00439a70
mov ecx, dword [esi]
add esp, 0x10
add ecx, 0x7491d8
push ebp
push edi
call fcn.00413730
mov edi, dword [esi]
xor ecx, ecx
mov cx, word [esi + 0x3a]
xor edx, edx
movsx eax, ax
mov dx, word [edi + ecx*2 + 0x74fb58]
imul edx, eax
mov dword [esp + 0xfc], edx
fild dword [esp + 0xfc]
fmul dword [0x485214]
call fcn.00479904
lea ecx, [edi + 0x74fd6c]
mov dword [esp + 0x1c], eax
call fcn.0041f8c0
mov ecx, dword [esp + 0x14]
and eax, 0xffff
cmp ecx, eax
jb 0x41bfdd
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8c0
mov ecx, dword [esp + 0x14]
and eax, 0xffff
cmp ecx, eax
jne 0x41bfff
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8d0
and eax, 0xffff
cmp ebp, eax
jae 0x41bfff
movsx ecx, word [esp + 0x1c]
mov dword [esp + 0xfc], ecx
fild dword [esp + 0xfc]
fmul dword [0x4851e8]
call fcn.00479904
mov edi, eax
jmp 0x41c003
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi]
push 0x41
add ecx, 0x208870
call fcn.004458e0
lea edx, [esp + 0xb4]
push eax
push edx
call fcn.00439b10
movsx eax, di
lea ecx, [esp + 0xbc]
push eax
push ecx
call fcn.004399b0
mov ecx, dword [esi]
add esp, 0x10
add ecx, 0x208870
push 0x42
call fcn.004458e0
lea edx, [esp + 0xb4]
push eax
push edx
call fcn.00439b10
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi]
add esp, 8
add ecx, 0x7491d8
push ebp
push eax
call fcn.00413800
lea ecx, [esp + 0xb8]
push eax
push ecx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x1e43b0
mov byte [esp + 0xbc], 1
push 0x48d6c0
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6c0
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea edx, [esp + 0x20]
lea ecx, [esi + 0x83618]
push edx
mov word [esp + 0xe6], ax
call fcn.004425d0
lea eax, [esp + 0xb4]
push eax
call fcn.00439990
lea ecx, [esp + 0xbc]
push ecx
call fcn.00439990
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x28]
add esp, 8
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x100]
lea eax, [ebp + ebp]
sub eax, ecx
mov word [esp + 0x22], 0x60
mov edx, eax
mov dword [esp + 0x60], 0
shl edx, 6
mov byte [esp + 0x68], bl
mov word [esp + 0x70], 2
lea eax, [edx + eax + 0x241]
mov word [esp + 0x76], 0x24
mov word [esp + 0x20], ax
mov eax, 0x80
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov eax, 0x10
mov dword [esp + 0x30], 0x3f400000
mov word [esp + 0x72], ax
mov word [esp + 0x74], ax
mov dword [esp + 0x34], 0x3f800000
mov ecx, dword [esi]
lea eax, [ebp + 0xe1]
push 0x48d6ec
add ecx, 0x1e43b0
mov dword [esp + 0x3c], 0x3f100000
mov dword [esp + 0x40], 0x3f500000
mov byte [esp + 0x6d], 1
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], 0x1f4
mov word [esp + 0x80], ax
mov word [esp + 0x82], 1
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d6b8
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea ecx, [esp + 0x20]
mov word [esp + 0xe2], ax
push ecx
lea ecx, [esi + 0x83618]
call fcn.004425d0
mov edx, dword [esp + 0x100]
mov dword [esp + 0x110], ebp
mov dword [esp + 0x114], ebx
mov ecx, 0x37
fild qword [esp + 0x110]
fld dword [0x485504]
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
fmul st(1)
fadd dword [0x485500]
lea eax, [ebp + ebp]
mov ecx, 0x60
sub eax, edx
mov word [esp + 0x22], cx
fstp dword [esp + 0x38]
mov edx, eax
mov word [esp + 0x2c], cx
fadd dword [0x4851d8]
shl edx, 6
mov word [esp + 0x2e], cx
mov ecx, dword [esp + 0x10c]
fmul dword [0x485504]
lea eax, [edx + eax + 0x241]
mov edx, dword [esp + 0x104]
mov word [esp + 0x20], ax
mov eax, 0x68
mov word [esp + 0x4c], ax
mov word [esp + 0x4e], ax
fstp dword [esp + 0x3c]
mov eax, 0x10
mov dword [esp + 0x60], 0
mov word [esp + 0x72], ax
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x14]
mov byte [esp + 0x68], 1
cmp eax, 4
mov word [esp + 0x70], 2
mov word [esp + 0x76], 0x24
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
jbe 0x41c30d
fld dword [esp + 0x30]
fsub dword [0x4854fc]
cmp eax, 9
fstp dword [esp + 0x30]
fld dword [esp + 0x34]
fsub dword [0x4854fc]
fstp dword [esp + 0x34]
jbe 0x41c30d
fld dword [esp + 0x30]
fsub dword [0x4854fc]
fstp dword [esp + 0x30]
fld dword [esp + 0x34]
fsub dword [0x4854fc]
fstp dword [esp + 0x34]
mov ecx, dword [esi]
lea eax, [ebp + 0xe1]
add ecx, 0x74fd6c
mov byte [esp + 0x69], 1
mov word [esp + 0x78], bx
mov word [esp + 0x7a], 0x1f4
mov word [esp + 0x7c], ax
mov word [esp + 0x7e], 1
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
call fcn.0041f8c0
mov edi, dword [esp + 0x14]
and eax, 0xffff
cmp edi, eax
jne 0x41c38d
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8d0
and eax, 0xffff
cmp ebp, eax
jbe 0x41c38d
mov eax, 0x60
mov word [esp + 0x70], 3
mov byte [esp + 0x68], bl
mov word [esp + 0x7c], bx
mov word [esp + 0x4c], ax
mov word [esp + 0x4e], ax
mov ecx, dword [esi]
push ebp
push edi
add ecx, 0x7491d8
call fcn.00413800
lea ecx, [esp + 0xb8]
push eax
push ecx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x7491d8
mov byte [esp + 0xbc], 1
call fcn.00413790
mov ecx, dword [esi]
push eax
add ecx, 0x1e43b0
call fcn.00449fc0
mov ecx, dword [esi]
mov word [esp + 0xc2], ax
add ecx, 0x7491d8
mov byte [esp + 0xdc], 1
call fcn.00413790
mov ecx, dword [esi]
push eax
add ecx, 0x1e43b0
call fcn.00449fc0
lea edx, [esp + 0x20]
lea ecx, [esi + 0x83618]
push edx
mov word [esp + 0xe6], ax
call fcn.004425d0
lea eax, [esp + 0xb8]
push eax
call fcn.00439990
mov ecx, dword [esi]
add esp, 4
add ecx, 0x74fd6c
call fcn.0041f8c0
and eax, 0xffff
cmp edi, eax
jne 0x41c569
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8d0
and eax, 0xffff
cmp ebp, eax
jbe 0x41c569
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push 0x48d6ec
rep stosd dword es:[edi], eax
mov ecx, ebp
mov eax, 0x60
shl ecx, 6
add ecx, ebp
mov word [esp + 0x26], ax
mov dword [esp + 0x64], 0
mov word [esp + 0x7a], 0x24
lea edx, [ecx + ecx + 0xfc]
mov ecx, 0x10
mov word [esp + 0x76], cx
mov word [esp + 0x78], cx
mov ecx, dword [esi]
mov word [esp + 0x24], dx
add ecx, 0x1e43b0
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x82], 1
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d6b4
mov word [esp + 0x74], 3
mov byte [esp + 0x6c], bl
mov word [esp + 0x80], bx
mov word [esp + 0x30], ax
mov word [esp + 0x32], ax
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov dword [esp + 0x3c], 0x3f500000
mov dword [esp + 0x40], 0x3f800000
mov dword [esp + 0x34], 0x3ec00000
mov dword [esp + 0x38], 0x3f100000
mov byte [esp + 0x6d], 1
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea eax, [esp + 0x20]
push eax
lea ecx, [esi + 0x83618]
call fcn.004425d0
mov edi, dword [esp + 0x14]
mov ecx, dword [esi]
push edi
add ecx, 0x7491d8
inc ebp
call fcn.004137e0
and eax, 0xffff
cmp ebp, eax
jb 0x41be34
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
mov byte [ecx + 0x61d], 1
mov ecx, dword [esi]
add ecx, 0x74fd6c
mov word [esi + 0x3a], 1
call fcn.0041ff00
mov ecx, dword [esi]
and eax, 0xffff
push eax
push 0x48d6a8
add ecx, 0x18fb50
call fcn.00445f00
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041ff00
test ax, ax
jne 0x41c5ee
push 3
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea ebp, [esi + 0x83618]
push ebx
push 0x48d688
mov ecx, ebp
mov word [esi + 0x12], 0x2c
call fcn.00443c40
mov edx, dword [esi]
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov dword [esp + 0x60], eax
mov eax, 0x10
mov word [esp + 0x22], 0x290
mov word [esp + 0x20], 0x329
mov word [esp + 0x2c], bx
mov word [esp + 0x2e], 0x20
mov word [esp + 0x70], 0xa
mov word [esp + 0x72], ax
mov word [esp + 0x74], ax
mov word [esp + 0x76], 0x21
mov word [esp + 0x7e], 1
mov dword [esp + 0x64], 0x3f000000
mov dword [esp + 0xb4], ebx
mov eax, dword [edx + 0x74fd68]
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x1e43b0
mov dword [esp + 0xb8], 0x48d680
push 0x48d3d0
mov byte [esp + 0x98], bl
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d3d0
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
mov word [esp + 0xe6], ax
call fcn.004425d0
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040f880
test al, al
je 0x41c707
push 0x7d0
push 0x7d0
push 0x48d678
mov ecx, ebp
call fcn.004426e0
push 0x48d674
mov ecx, ebp
call fcn.00442db0
mov di, ax
mov ecx, ebp
and edi, 0xffff
push edi
call fcn.004425b0
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x74fd6c
call fcn.0041f930
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x18]
add esp, 8
mov ecx, ebp
push edx
push edi
call fcn.00442cb0
lea eax, [esp + 0x10]
push eax
call fcn.00439990
mov ecx, dword [esi]
add esp, 4
add ecx, 0x74fd6c
call fcn.0041f8c0
mov ecx, dword [esi]
push eax
add ecx, 0x7491d8
call fcn.004136d0
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8d0
mov ecx, dword [esi]
push eax
add ecx, 0x7491d8
call fcn.004136e0
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f900
mov ecx, dword [esi]
push eax
add ecx, 0x74fef4
call fcn.00429160
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8e0
mov ecx, dword [esi]
push eax
add ecx, 0x74fef4
call fcn.00428990
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041ff00
cmp ax, 1
push ebx
lea ecx, [esi + 0x83618]
jne 0x41c801
push 0x48d64c
jmp 0x41c806
push 0x48d628
call fcn.00443c40
mov ecx, dword [esi]
xor ebp, ebp
add ecx, 0x74fd6c
call fcn.0041ff00
test ax, ax
jbe 0x41c976
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f930
mov ecx, dword [esi]
push eax
push ebp
add ecx, 0x74fd6c
call fcn.0041ff10
push eax
call fcn.004398a0
add esp, 8
test al, al
jne 0x41c868
mov ecx, dword [esi]
inc ebp
add ecx, 0x74fd6c
call fcn.0041ff00
and eax, 0xffff
cmp ebp, eax
jb 0x41c823
jmp 0x41c976
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push 0x48d6ec
rep stosd dword es:[edi], eax
lea eax, [ebp*8]
mov word [esp + 0x24], 0x200
sub eax, ebp
mov word [esp + 0x30], 0x1ce
mov word [esp + 0x32], 0x20
mov dword [esp + 0x64], 0
lea ecx, [eax + eax*4 + 0xf0]
mov eax, 0x10
mov word [esp + 0x26], cx
mov ecx, dword [esi]
add ecx, 0x1e43b0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 3
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x24
mov dword [esp + 0x3c], 0x3f700000
mov dword [esp + 0x40], 0x3f800000
mov dword [esp + 0x34], 0x3f400000
mov dword [esp + 0x38], 0x3f500000
mov byte [esp + 0x6d], 1
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x80], bx
mov word [esp + 0x82], 1
mov byte [esp + 0x98], bl
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d620
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea edx, [esp + 0x20]
lea ecx, [esi + 0x83618]
push edx
mov word [esp + 0xe6], ax
call fcn.004425d0
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
mov ebp, 0x10
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
push 0x48d380
add ecx, 0x1e43b0
mov dword [esp + 0x64], eax
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 9
mov dword [esp + 0x68], 0x3f800000
mov word [esp + 0x76], bp
mov word [esp + 0x78], bp
mov word [esp + 0x7a], 0x24
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], 0x1f4
mov word [esp + 0x80], bx
mov word [esp + 0x82], bx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d380
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov ecx, dword [esi]
mov word [esp + 0xe2], ax
add ecx, 0x74fd6c
call fcn.0041ff00
test ax, ax
jbe 0x41cae8
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x20]
push ebx
rep stosd dword es:[edi], eax
mov ecx, 8
lea edi, [esp + 0x44]
rep stosd dword es:[edi], eax
lea eax, [ebx*8]
lea ecx, [ebx + 0x64]
sub eax, ebx
mov word [esp + 0x80], cx
mov ecx, dword [esi]
mov word [esp + 0x24], 0x200
lea eax, [eax + eax*4 + 0xf0]
add ecx, 0x74fd6c
mov word [esp + 0x26], ax
mov word [esp + 0x30], bp
mov word [esp + 0x32], 0x20
call fcn.0041ff10
lea edx, [esp + 0xb8]
push eax
push edx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x74fd6c
push ebx
call fcn.0041ff10
push eax
lea eax, [esp + 0xb8]
push eax
call fcn.00439930
add esp, 8
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esi + 0x83618]
call fcn.004425d0
mov ecx, dword [esi]
inc ebx
add ecx, 0x74fd6c
call fcn.0041ff00
and eax, 0xffff
cmp ebx, eax
jb 0x41ca34
lea edx, [esp + 0xb4]
jmp 0x41edef
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041ff00
cmp ax, 7
lea ecx, [esi + 0x83618]
push ebx
jb 0x41cb25
push 0x48d5f8
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
push 0x48d5d0
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea ebp, [esi + 0x83618]
push 0x48d5c8
mov ecx, ebp
call fcn.00442db0
test ax, ax
je case.0x41ec12.607
push 0x48d5c8
mov ecx, ebp
call fcn.00442db0
push eax
mov ecx, ebp
call fcn.004425b0
mov ecx, dword [esi]
mov edi, eax
push edi
push 0x48d5c0
add ecx, 0x18fb50
call fcn.00445df0
push edi
call fcn.004397e0
push eax
mov dword [esp + 0x18], eax
call fcn.00439900
add esp, 8
cmp ax, 1
jae 0x41cbb3
push ebx
push 0x48d598
mov ecx, ebp
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov eax, dword [esp + 0x10]
xor edi, edi
push eax
call fcn.00439900
add esp, 4
test ax, ax
jbe 0x41cbfa
mov eax, dword [esp + 0x10]
cmp byte [edi + eax], 0x20
jne 0x41cbfe
push eax
inc edi
call fcn.00439900
and eax, 0xffff
add esp, 4
cmp edi, eax
je 0x41cb99
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00439900
and eax, 0xffff
add esp, 4
cmp edi, eax
jb 0x41cbc7
mov eax, dword [esp + 0x10]
mov ecx, dword [esi]
push eax
push 0x48d590
add ecx, 0x18fb50
call fcn.00445df0
mov edx, dword [esp + 0x10]
mov ecx, dword [esi]
push edx
add ecx, 0x74fd6c
call fcn.0041fa30
mov di, ax
and edi, 0xffff
jne 0x41cc37
push 1
mov ecx, esi
call fcn.004198f0
cmp edi, 1
jne 0x41cc53
push ebx
push 0x48d5f8
mov ecx, ebp
call fcn.00443c40
lea eax, [esp + 0x10]
push eax
jmp 0x41edf0
cmp edi, 2
jne 0x41cc65
push ebx
push 0x48d56c
mov ecx, ebp
call fcn.00443c40
lea eax, [esp + 0x10]
push eax
jmp 0x41edf0
lea edi, [esi + 0x83618]
push ebx
push 0x48d544
mov ecx, edi
call fcn.00443c40
push 0x48d53c
mov ecx, edi
call fcn.00442db0
mov ecx, dword [esi]
mov bx, ax
add ecx, 0x74fd6c
and ebx, 0xffff
call fcn.0041f930
push eax
push ebx
mov ecx, edi
call fcn.00442cb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041fb20
push 2
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
lea ebp, [esi + 0x83618]
push ebx
push 0x48d51c
mov ecx, ebp
call fcn.00443c40
mov ecx, dword [esi]
xor eax, eax
lea edi, [esp + 0x20]
push 0x48d514
mov byte [ecx + 0x74ff1c], 1
mov ecx, 0x37
rep stosd dword es:[edi], eax
mov ecx, ebp
call fcn.00442db0
mov ecx, dword [esi]
mov di, ax
push 0x4f
add ecx, 0x208870
and edi, 0xffff
call fcn.004458e0
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x74fef4
call fcn.00428ed0
and eax, 0xffff
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439a70
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
push edi
mov ecx, ebp
call fcn.00442cb0
push 0x48d50c
mov ecx, ebp
call fcn.00442db0
mov ecx, dword [esi]
mov di, ax
push 0x51
add ecx, 0x208870
and edi, 0xffff
call fcn.004458e0
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x74fef4
call fcn.00428fa0
and eax, 0xffff
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439a70
mov ecx, dword [esi]
add esp, 8
add ecx, 0x208870
push 0x52
call fcn.004458e0
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x18]
add esp, 8
mov ecx, ebp
push edx
push edi
call fcn.00442cb0
push 0x48d504
mov ecx, ebp
call fcn.00442db0
mov di, ax
and edi, 0xffff
mov ecx, dword [esi]
push 0x50
add ecx, 0x208870
call fcn.004458e0
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x74fef4
call fcn.00429040
and eax, 0xffff
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439a70
lea edx, [esp + 0x18]
push 0x48d500
push edx
call fcn.00439b10
mov eax, dword [esp + 0x20]
add esp, 0x10
mov ecx, ebp
push eax
push edi
call fcn.00442cb0
push 0x48d4f8
mov ecx, ebp
call fcn.00442db0
mov ecx, dword [esi]
mov di, ax
push 0x53
add ecx, 0x208870
and edi, 0xffff
call fcn.004458e0
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x74fef4
push 2
call fcn.00429090
and eax, 0xffff
push ecx
mov dword [esp + 0x10c], eax
lea edx, [esp + 0x18]
fild dword [esp + 0x10c]
fmul dword [0x4854f8]
fstp dword [esp]
push edx
call fcn.00439a30
mov ecx, dword [esi]
add esp, 0xc
add ecx, 0x208870
push 0x54
call fcn.004458e0
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439b10
mov ecx, dword [esp + 0x18]
add esp, 8
push ecx
push edi
mov ecx, ebp
call fcn.00442cb0
mov dword [esp + 0x14], ebx
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
mov word [esp + 0x20], 0x8c
mov dword [esp + 0x60], 0
mov byte [esp + 0x68], bl
lea edx, [eax + eax*8]
mov word [esp + 0x70], 3
mov word [esp + 0x76], 0x24
mov word [esp + 0x78], bx
lea ecx, [eax + edx*2]
mov edx, pe_nt_image_headers32
shl ecx, 2
mov dword [esp + 0x100], ecx
add ecx, 0xa6
mov word [esp + 0x22], cx
mov word [esp + 0x2c], dx
mov word [esp + 0x2e], dx
mov ecx, 1
mov edx, 8
cmp eax, 4
mov word [esp + 0x28], cx
mov word [esp + 0x2a], cx
mov word [esp + 0x72], dx
mov word [esp + 0x74], dx
mov word [esp + 0x7a], 0x1f4
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], cx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], 0x48d4f4
mov byte [esp + 0x94], al
mov byte [esp + 0x1b], cl
ja case.default.0x41cfa2
jmp dword [eax*4 + 0x41ef68]
mov eax, dword [esi]
mov cx, word [eax + 0x74fb86]
mov word [esp + 0x1c], cx
mov cl, byte [eax + 0x74ff24]
test cl, 1
je 0x41cfd6
mov byte [esp + 0x94], 8
mov dx, word [eax + 0x74fb90]
mov word [esp + 0x1c], dx
test byte [eax + 0x74ff24], 0x20
je 0x41cffc
mov cl, byte [esp + 0x94]
add cl, 0x10
mov byte [esp + 0x94], cl
mov cx, word [eax + 0x74fb9a]
mov word [esp + 0x1c], cx
mov ecx, dword [eax + 0x74ff24]
test ch, 4
je 0x41d024
mov cl, byte [esp + 0x94]
add cl, 0x18
mov byte [esp + 0x94], cl
mov dx, word [eax + 0x74fba4]
mov word [esp + 0x1c], dx
mov ecx, dword [eax + 0x74ff24]
test ch, ch
jns case.default.0x41cfa2
jmp 0x41d261
mov eax, dword [esi]
mov cx, word [eax + 0x74fb88]
mov word [esp + 0x1c], cx
mov cl, byte [eax + 0x74ff24]
test cl, 2
je 0x41d064
mov byte [esp + 0x94], 9
mov dx, word [eax + 0x74fb92]
mov word [esp + 0x1c], dx
test byte [eax + 0x74ff24], 0x40
je 0x41d08a
mov cl, byte [esp + 0x94]
add cl, 0x10
mov byte [esp + 0x94], cl
mov cx, word [eax + 0x74fb9c]
mov word [esp + 0x1c], cx
mov ecx, dword [eax + 0x74ff24]
test ch, 8
je 0x41d0b2
mov cl, byte [esp + 0x94]
add cl, 0x18
mov byte [esp + 0x94], cl
mov dx, word [eax + 0x74fba6]
mov word [esp + 0x1c], dx
test dword [eax + 0x74ff24], 0x10000
jmp 0x41d25f
mov eax, dword [esi]
mov cx, word [eax + 0x74fb8a]
mov word [esp + 0x1c], cx
mov cl, byte [eax + 0x74ff24]
test cl, 4
je 0x41d0ee
mov byte [esp + 0x94], 0xa
mov dx, word [eax + 0x74fb94]
mov word [esp + 0x1c], dx
mov cl, byte [eax + 0x74ff24]
test cl, cl
jns 0x41d115
mov cl, byte [esp + 0x94]
add cl, 0x10
mov byte [esp + 0x94], cl
mov cx, word [eax + 0x74fb9e]
mov word [esp + 0x1c], cx
mov ecx, dword [eax + 0x74ff24]
test ch, 0x10
je 0x41d13d
mov cl, byte [esp + 0x94]
add cl, 0x18
mov byte [esp + 0x94], cl
mov dx, word [eax + 0x74fba8]
mov word [esp + 0x1c], dx
test dword [eax + 0x74ff24], 0x20000
jmp 0x41d25f
mov eax, dword [esi]
mov cx, word [eax + 0x74fb8c]
mov word [esp + 0x1c], cx
mov cl, byte [eax + 0x74ff24]
test cl, 8
je 0x41d179
mov byte [esp + 0x94], 0xb
mov dx, word [eax + 0x74fb96]
mov word [esp + 0x1c], dx
mov ecx, dword [eax + 0x74ff24]
test ch, 1
je 0x41d1a1
mov cl, byte [esp + 0x94]
add cl, 0x10
mov byte [esp + 0x94], cl
mov cx, word [eax + 0x74fba0]
mov word [esp + 0x1c], cx
mov ecx, dword [eax + 0x74ff24]
test ch, 0x20
je 0x41d1c9
mov cl, byte [esp + 0x94]
add cl, 0x18
mov byte [esp + 0x94], cl
mov dx, word [eax + 0x74fbaa]
mov word [esp + 0x1c], dx
test dword [eax + 0x74ff24], 0x40000
jmp 0x41d25f
mov eax, dword [esi]
mov cx, word [eax + 0x74fb8e]
mov word [esp + 0x1c], cx
mov cl, byte [eax + 0x74ff24]
test cl, 0x10
je 0x41d205
mov byte [esp + 0x94], 0xc
mov dx, word [eax + 0x74fb98]
mov word [esp + 0x1c], dx
mov ecx, dword [eax + 0x74ff24]
test ch, 2
je 0x41d22d
mov cl, byte [esp + 0x94]
add cl, 0x10
mov byte [esp + 0x94], cl
mov cx, word [eax + 0x74fba2]
mov word [esp + 0x1c], cx
mov ecx, dword [eax + 0x74ff24]
test ch, 0x40
je 0x41d255
mov cl, byte [esp + 0x94]
add cl, 0x18
mov byte [esp + 0x94], cl
mov dx, word [eax + 0x74fbac]
mov word [esp + 0x1c], dx
test dword [eax + 0x74ff24], 0x80000
je case.default.0x41cfa2
mov al, byte [esp + 0x94]
mov byte [esp + 0x1b], bl
add al, 0x20
mov byte [esp + 0x94], al
movsx edi, word [esp + 0x1c]
mov ecx, dword [esi]
mov dword [esp + 0xfc], edi
add ecx, 0x74fd6c
call fcn.0041f920
cmp eax, edi
jb 0x41d2e8
cmp byte [esp + 0x1b], bl
je 0x41d2e8
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xb8]
add eax, 0xaf
push 0x48d4f0
push ecx
mov word [esp + 0x78], 2
mov word [esp + 0x82], 0x1f4
mov word [esp + 0x84], ax
mov dword [esp + 0xc0], ebx
call fcn.00439930
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0xc0]
push edx
push eax
call fcn.00439a70
add esp, 0x10
mov ecx, dword [esi]
push 0x48d4e8
add ecx, 0x1e43b0
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d4e8
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea ecx, [esp + 0x20]
mov word [esp + 0xe2], ax
push ecx
mov ecx, ebp
call fcn.004425d0
lea edx, [esp + 0xb4]
push edx
call fcn.00439990
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0xbc]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x104]
mov cx, word [esp + 0x20]
add eax, 0xa0
push 0x48d4e0
mov word [esp + 0x2a], ax
mov eax, 0x10
push edx
mov word [esp + 0x2c], 0xbc
mov word [esp + 0x38], 8
mov word [esp + 0x3a], ax
mov dword [esp + 0x6c], 0
mov byte [esp + 0x74], bl
mov word [esp + 0x7c], 0xa
mov dword [esp + 0x70], 0x3f000000
mov word [esp + 0x7e], ax
mov word [esp + 0x80], ax
mov word [esp + 0x82], 0x21
mov word [esp + 0x84], cx
mov word [esp + 0x86], bx
mov word [esp + 0x88], bx
mov word [esp + 0x8a], bx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc0], ebx
call fcn.00439930
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc4]
push eax
push ecx
call fcn.004399b0
mov ecx, dword [esi]
mov al, byte [esp + 0x2f]
add esp, 0x14
add ecx, 0x208870
cmp al, bl
je 0x41d446
push 0x3c
call fcn.004458e0
lea edx, [esp + 0xb4]
push eax
push edx
call fcn.00439930
mov eax, dword [esp + 0x104]
lea ecx, [esp + 0xbc]
push eax
push ecx
call fcn.004399b0
add esp, 0x10
jmp 0x41d45e
push pe_nt_image_headers32
call fcn.004458e0
lea edx, [esp + 0xb4]
push eax
push edx
call fcn.00439930
add esp, 8
mov ecx, dword [esi]
push 0x48d3d0
add ecx, 0x1e43b0
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d3d0
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea eax, [esp + 0x20]
push eax
mov ecx, ebp
call fcn.004425d0
lea ecx, [esp + 0xb8]
push ecx
call fcn.00439990
lea edx, [esp + 0xb8]
push edx
call fcn.00439990
mov ecx, dword [esi]
add esp, 8
add ecx, 0x74fd6c
call fcn.0041f920
cmp eax, dword [esp + 0xfc]
jae 0x41d71b
cmp byte [esp + 0x1b], bl
je 0x41d71b
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push 0x48d6ec
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x104]
mov ecx, pe_nt_image_headers32
mov word [esp + 0x30], cx
mov word [esp + 0x32], cx
mov ecx, 0x10
add eax, 0xa6
mov word [esp + 0x76], cx
mov word [esp + 0x78], cx
mov ecx, dword [esi]
mov word [esp + 0x26], ax
mov eax, 1
add ecx, 0x1e43b0
mov word [esp + 0x24], 0x8c
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 2
mov word [esp + 0x7a], 0x24
mov byte [esp + 0x6d], al
mov dword [esp + 0x3c], 0x3f400000
mov dword [esp + 0x40], 0x3f600000
mov dword [esp + 0x34], 0x3e000000
mov dword [esp + 0x38], 0x3e800000
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], 0x1f4
mov word [esp + 0x80], 0x21
mov word [esp + 0x82], ax
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d4dc
mov byte [esp + 0x98], bl
mov byte [esp + 0x99], bl
mov byte [esp + 0xc0], al
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea ecx, [esp + 0x20]
mov word [esp + 0xe2], ax
push ecx
mov ecx, ebp
call fcn.004425d0
mov edx, dword [esp + 0x100]
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
add edx, 0xb0
mov eax, 0x10
push 0x63
add ecx, 0x208870
mov word [esp + 0x26], dx
mov word [esp + 0x24], 0xbc
mov word [esp + 0x30], 8
mov word [esp + 0x32], ax
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 0xa
mov dword [esp + 0x68], 0x3f000000
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x21
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x80], bx
mov word [esp + 0x82], bx
mov dword [esp + 0xbc], 0x48d4d4
mov dword [esp + 0xb8], ebx
call fcn.004458e0
push eax
lea eax, [esp + 0xb8]
push eax
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x1e43b0
mov byte [esp + 0xbc], 1
push 0x48da40
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48da40
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea ecx, [esp + 0x20]
mov word [esp + 0xe2], ax
push ecx
mov ecx, ebp
call fcn.004425d0
lea edx, [esp + 0xb4]
push edx
call fcn.00439990
add esp, 4
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f920
cmp eax, dword [esp + 0xfc]
jb 0x41d8b1
cmp byte [esp + 0x1b], bl
je 0x41d8b1
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0xb8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x100]
mov ecx, dword [esp + 0x14]
add eax, 0x9a
add ecx, 0xaf
mov word [esp + 0x22], ax
mov eax, 0x20
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov eax, 0x10
push 0x48d4f0
push edx
mov word [esp + 0x28], 0x6c
mov dword [esp + 0x68], 0
mov byte [esp + 0x70], bl
mov word [esp + 0x78], 2
mov word [esp + 0x7a], ax
mov word [esp + 0x7c], ax
mov word [esp + 0x7e], 0x24
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x3e000000
mov dword [esp + 0x38], 0x3f400000
mov dword [esp + 0x3c], 0x3f600000
mov byte [esp + 0x71], 1
mov dword [esp + 0x60], 0x3e000000
mov dword [esp + 0x64], 0x3e800000
mov dword [esp + 0x58], 0x3f400000
mov dword [esp + 0x5c], 0x3f600000
mov byte [esp + 0x72], 1
mov word [esp + 0x80], bx
mov word [esp + 0x82], 0x1f4
mov word [esp + 0x84], cx
mov word [esp + 0x86], 1
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov byte [esp + 0x9c], 1
call fcn.00439930
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0xc0]
push eax
push ecx
call fcn.00439a70
mov ecx, dword [esi]
add esp, 0x10
add ecx, 0x1e43b0
mov byte [esp + 0xbc], 1
push 0x48d6ec
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
mov word [esp + 0xe6], ax
call fcn.004425d0
lea eax, [esp + 0xb8]
push eax
call fcn.00439990
add esp, 4
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 5
mov dword [esp + 0x14], eax
jb 0x41cee8
mov ecx, dword [esi]
mov eax, dword [ecx + 0x74ff20]
dec eax
xor edi, edi
mov dword [esp + 0x104], eax
mov dword [esp + 0x14], edi
mov ecx, dword [esi]
inc edi
add ecx, 0x74fef4
mov dword [esp + 0x104], edi
call fcn.00428a10
cmp edi, eax
jne 0x41da1a
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push 0x48d6ec
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x18]
mov word [esp + 0x24], 0x31a
mov word [esp + 0x30], 0x140
mov word [esp + 0x32], 0x60
lea edx, [eax + eax*8]
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 3
lea eax, [eax + edx*2]
mov word [esp + 0x7a], 0x24
mov dword [esp + 0x3c], 0x3f000000
mov dword [esp + 0x40], 0x3f800000
lea ecx, [eax*4 + 0xa6]
mov eax, 1
mov word [esp + 0x26], cx
mov ecx, 0x10
mov word [esp + 0x76], cx
mov word [esp + 0x78], cx
mov ecx, dword [esi]
mov word [esp + 0x2c], ax
add ecx, 0x1e43b0
mov word [esp + 0x2e], ax
mov byte [esp + 0x6d], al
mov dword [esp + 0x34], 0x3f100000
mov dword [esp + 0x38], 0x3f400000
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x80], bx
mov word [esp + 0x82], ax
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d4dc
mov byte [esp + 0x98], bl
mov byte [esp + 0x99], bl
mov byte [esp + 0xc0], al
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
mov word [esp + 0xe6], ax
call fcn.004425d0
mov edi, dword [esp + 0x104]
cmp edi, 6
mov dword [esp + 0x14], edi
jb 0x41d8d9
xor edx, edx
mov dword [esp + 0x100], 0x74fb78
mov dword [esp + 0x14], edx
jmp 0x41da3e
mov edx, dword [esp + 0x14]
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
mov dword [esp + 0x1c], ebx
rep stosd dword es:[edi], eax
lea eax, [edx + edx*8]
mov cl, dl
add cl, 0x28
mov word [esp + 0x20], 0x2ee
lea eax, [edx + eax*2]
mov dword [esp + 0x60], 0
shl eax, 2
mov dword [esp + 0xfc], eax
add eax, 0xa6
mov word [esp + 0x22], ax
mov eax, 2
mov word [esp + 0x28], ax
mov word [esp + 0x2a], ax
mov eax, pe_nt_image_headers32
mov byte [esp + 0x68], bl
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov eax, 8
mov word [esp + 0x70], 3
mov word [esp + 0x72], ax
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x100]
mov word [esp + 0x76], 0x24
cmp eax, 0x74fb82
mov word [esp + 0x78], bx
mov word [esp + 0x7a], bx
mov word [esp + 0x7e], 1
mov byte [esp + 0x94], cl
ja 0x41db42
jmp dword [edx*4 + 0x41ef7c]
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f920
movsx edx, word [esp + 0x1c]
cmp edx, eax
ja 0x41db99
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push eax
add ecx, 0x74fd6c
call fcn.0041f960
test eax, eax
jne 0x41db99
mov ecx, dword [esp + 0x14]
mov word [esp + 0x70], 2
add ecx, 0x96
mov word [esp + 0x7a], 0x1f4
mov word [esp + 0x7c], cx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
lea edx, [esp + 0xb8]
push 0x48d4d0
push edx
call fcn.00439930
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0xc0]
push eax
push ecx
call fcn.00439a70
mov edx, dword [esp + 0x24]
mov ecx, dword [esi]
add esp, 0x10
add ecx, 0x74fd6c
push edx
call fcn.0041f960
test eax, eax
je 0x41dbf2
mov eax, dword [esp + 0x14]
mov word [esp + 0x70], 2
add eax, 0x226
mov word [esp + 0x7a], 0x1f4
mov word [esp + 0x7c], ax
mov ecx, dword [esi]
push 0x48d4e8
add ecx, 0x1e43b0
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d4e8
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea ecx, [esp + 0x20]
mov word [esp + 0xe2], ax
push ecx
mov ecx, ebp
call fcn.004425d0
mov edx, dword [esp + 0xfc]
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
mov eax, 0x10
mov word [esp + 0x2e], ax
mov word [esp + 0x72], ax
mov word [esp + 0x74], ax
mov eax, dword [esp + 0x14]
add eax, 0x55
add edx, 0x90
push eax
add ecx, 0x208870
mov word [esp + 0x26], dx
mov word [esp + 0x24], 0x31e
mov word [esp + 0x30], bx
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 0xa
mov dword [esp + 0x68], 0x3f000000
mov word [esp + 0x7a], 0x21
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x80], bx
mov word [esp + 0x82], bx
mov dword [esp + 0xbc], 0x48d4f4
mov dword [esp + 0xb8], ebx
call fcn.004458e0
lea ecx, [esp + 0xb4]
push eax
push ecx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x1e43b0
mov byte [esp + 0xbc], 1
push 0x48d3d0
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d3d0
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov edx, dword [esp + 0x14]
mov ecx, dword [esi]
push edx
add ecx, 0x74fd6c
mov word [esp + 0xe6], ax
call fcn.0041f960
test eax, eax
je 0x41dd99
mov ecx, dword [esi]
add ecx, 0x74fef4
call fcn.00428a10
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, eax
jne 0x41dd99
mov ecx, dword [esi]
push 0x48d380
add ecx, 0x1e43b0
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d380
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
call fcn.00449fc0
mov word [esp + 0xe2], ax
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
call fcn.004425d0
lea eax, [esp + 0xb4]
push eax
call fcn.00439990
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x24]
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xfc]
mov eax, 0x10
add ecx, 0xa0
push 0x48d3d0
mov word [esp + 0x26], cx
mov ecx, dword [esi]
add ecx, 0x1e43b0
mov word [esp + 0x24], 0x31e
mov word [esp + 0x30], bx
mov word [esp + 0x32], ax
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 0xa
mov dword [esp + 0x68], 0x3f000000
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x21
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x80], bx
mov word [esp + 0x82], bx
mov dword [esp + 0xbc], 0x48d4f4
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xc0], 1
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d3d0
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
mov edx, dword [esp + 0x14]
mov ecx, dword [esi]
push edx
add ecx, 0x74fd6c
mov word [esp + 0xe6], ax
call fcn.0041f960
test eax, eax
je 0x41dee8
mov ecx, dword [esi]
add ecx, 0x74fef4
call fcn.00428a10
mov ecx, dword [esp + 0x14]
inc ecx
cmp ecx, eax
jne 0x41df2b
mov ecx, dword [esi]
push 0x48d380
add ecx, 0x1e43b0
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d380
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
call fcn.00449fc0
mov word [esp + 0xe2], ax
jmp 0x41df2b
mov eax, dword [esi]
mov edx, dword [esp + 0x100]
push 0x3c
mov di, word [edx + eax]
lea ecx, [eax + 0x208870]
mov dword [esp + 0x108], edi
call fcn.004458e0
push eax
lea eax, [esp + 0xb8]
push eax
call fcn.00439930
movsx ecx, di
lea edx, [esp + 0xbc]
push ecx
push edx
call fcn.004399b0
add esp, 0x10
cmp dword [esp + 0xb4], ebx
je 0x41df40
lea eax, [esp + 0x20]
mov ecx, ebp
push eax
call fcn.004425d0
lea ecx, [esp + 0xb4]
push ecx
call fcn.00439990
mov eax, dword [esp + 0x104]
add esp, 4
cmp eax, 0x74fb82
ja 0x41dfab
mov edx, dword [esp + 0x14]
jmp dword [edx*4 + 0x41ef94]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f920
movsx ecx, di
cmp ecx, eax
jbe 0x41e209
mov edx, dword [esp + 0x14]
mov ecx, dword [esi]
push edx
add ecx, 0x74fd6c
call fcn.0041f960
test eax, eax
jne 0x41e209
mov ecx, 0x37
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xfc]
mov ecx, pe_nt_image_headers32
mov word [esp + 0x2c], cx
mov word [esp + 0x2e], cx
mov ecx, 0x10
add eax, 0xa6
mov word [esp + 0x72], cx
mov word [esp + 0x74], cx
mov ecx, dword [esi]
mov word [esp + 0x22], ax
mov eax, 1
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0x24], 0x2ee
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 2
mov word [esp + 0x7a], 0x24
mov byte [esp + 0x6d], al
mov dword [esp + 0x3c], 0x3f400000
mov dword [esp + 0x40], 0x3f600000
mov dword [esp + 0x34], 0x3e000000
mov dword [esp + 0x38], 0x3e800000
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], 0x1f4
mov word [esp + 0x80], 0x21
mov word [esp + 0x82], ax
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d4dc
mov byte [esp + 0x98], bl
mov byte [esp + 0x99], bl
mov byte [esp + 0xc0], al
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea ecx, [esp + 0x20]
mov word [esp + 0xe2], ax
push ecx
mov ecx, ebp
call fcn.004425d0
mov edx, dword [esp + 0xfc]
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esi]
add edx, 0xb0
mov eax, 0x10
push 0x63
add ecx, 0x208870
mov word [esp + 0x26], dx
mov word [esp + 0x24], 0x31e
mov word [esp + 0x30], bx
mov word [esp + 0x32], ax
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 0xa
mov dword [esp + 0x68], 0x3f000000
mov word [esp + 0x76], ax
mov word [esp + 0x78], ax
mov word [esp + 0x7a], 0x21
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], bx
mov word [esp + 0x80], bx
mov word [esp + 0x82], bx
mov dword [esp + 0xbc], 0x48d4d4
mov dword [esp + 0xb8], ebx
call fcn.004458e0
push eax
lea eax, [esp + 0xb8]
push eax
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x1e43b0
mov byte [esp + 0xbc], 1
push 0x48da40
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48da40
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea ecx, [esp + 0x20]
mov word [esp + 0xe2], ax
push ecx
mov ecx, ebp
call fcn.004425d0
lea edx, [esp + 0xb4]
push edx
call fcn.00439990
add esp, 4
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push eax
add ecx, 0x74fd6c
call fcn.0041f960
test eax, eax
jbe 0x41e341
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
push 0x48d6ec
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x100]
mov eax, 1
add ecx, 0xae
mov word [esp + 0x24], 0x2fe
mov word [esp + 0x26], cx
mov ecx, pe_nt_image_headers32
mov word [esp + 0x30], cx
mov word [esp + 0x32], cx
mov ecx, 0x10
mov word [esp + 0x2c], ax
mov word [esp + 0x76], cx
mov word [esp + 0x78], cx
mov ecx, dword [esi]
mov word [esp + 0x2e], ax
add ecx, 0x1e43b0
mov dword [esp + 0x64], 0
mov byte [esp + 0x6c], bl
mov word [esp + 0x74], 3
mov word [esp + 0x7a], 0x24
mov byte [esp + 0x6d], al
mov dword [esp + 0x3c], 0x3f400000
mov dword [esp + 0x40], 0x3f600000
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0x3e000000
mov word [esp + 0x7c], bx
mov word [esp + 0x7e], 0x1f4
mov word [esp + 0x80], 0x21
mov word [esp + 0x82], ax
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], 0x48d4cc
mov byte [esp + 0x98], bl
mov byte [esp + 0x99], bl
mov byte [esp + 0xc0], al
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
mov word [esp + 0xe6], ax
call fcn.004425d0
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push eax
add ecx, 0x74fd6c
call fcn.0041f960
test eax, eax
jne 0x41e4e5
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f920
mov ecx, dword [esp + 0x104]
movsx edx, cx
cmp eax, edx
jb 0x41e4e5
cmp cx, bx
je 0x41e4e5
mov ecx, 0x37
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0xb8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0x14]
add eax, 0x9a
add ecx, 0x96
mov word [esp + 0x22], ax
mov eax, 0x20
mov word [esp + 0x2c], ax
mov word [esp + 0x2e], ax
mov eax, 0x10
push 0x48d4d0
push edx
mov word [esp + 0x28], 0x2ce
mov dword [esp + 0x68], 0
mov byte [esp + 0x70], bl
mov word [esp + 0x78], 2
mov word [esp + 0x7a], ax
mov word [esp + 0x7c], ax
mov word [esp + 0x7e], 0x24
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x3e000000
mov dword [esp + 0x38], 0x3f400000
mov dword [esp + 0x3c], 0x3f600000
mov byte [esp + 0x71], 1
mov dword [esp + 0x60], 0x3e000000
mov dword [esp + 0x64], 0x3e800000
mov dword [esp + 0x58], 0x3f400000
mov dword [esp + 0x5c], 0x3f600000
mov byte [esp + 0x72], 1
mov word [esp + 0x80], bx
mov word [esp + 0x82], 0x1f4
mov word [esp + 0x84], cx
mov word [esp + 0x86], 1
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov byte [esp + 0x9c], 1
call fcn.00439930
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0xc0]
push eax
push ecx
call fcn.00439a70
mov ecx, dword [esi]
add esp, 0x10
add ecx, 0x1e43b0
mov byte [esp + 0xbc], 1
push 0x48d6ec
call fcn.00449fc0
mov ecx, dword [esi]
push 0x48d6ec
add ecx, 0x1e43b0
mov word [esp + 0xc6], ax
mov byte [esp + 0xe0], 1
call fcn.00449fc0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
mov word [esp + 0xe6], ax
call fcn.004425d0
mov eax, dword [esp + 0x100]
mov edi, dword [esp + 0x14]
add eax, 2
inc edi
cmp eax, 0x74fb84
mov dword [esp + 0x14], edi
mov dword [esp + 0x100], eax
jb 0x41da3a
push 0x48d4c4
mov ecx, ebp
call fcn.00442db0
mov di, ax
mov ecx, ebp
and edi, 0xffff
push edi
call fcn.004425b0
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
add ecx, 0x74fd6c
call fcn.0041f920
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439a70
mov edx, dword [esp + 0x18]
add esp, 8
mov ecx, ebp
push edx
push edi
call fcn.00442cb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov eax, dword [esi]
add esi, 0x83618
mov ecx, esi
mov byte [eax + 0x74ff1c], bl
call fcn.00442c20
push 1
push 0x48d4a0
mov ecx, esi
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ebp, 0xffffff9c
push ebp
add ecx, 0x74fd6c
call fcn.0041fed0
push 2
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
cmp eax, 0x258
jg 0x41ebfc
je 0x41eba3
cmp eax, 0xea
jg 0x41eb5d
cmp eax, 0xe1
jge 0x41eb33
sub eax, 0x96
cmp eax, 0x3e
ja case.0x41ec12.607
xor ecx, ecx
mov cl, byte [eax + 0x41efbc]
jmp dword [ecx*4 + 0x41efac]
mov ecx, dword [esi]
add ebp, 0xffffff38
push ebp
add ecx, 0x7491d8
call fcn.004136d0
mov ecx, dword [esi]
push ebp
add ecx, 0x7491d8
call fcn.004137e0
mov bx, ax
and ebx, 0xffff
jbe 0x41e633
dec ebx
mov ecx, dword [esi]
push ebx
add ecx, 0x7491d8
call fcn.004136e0
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8c0
and eax, 0xffff
add edi, 0xffffff38
cmp edi, eax
jne 0x41e68e
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8d0
and eax, 0xffff
cmp ebx, eax
jb 0x41e68e
mov ecx, dword [esi]
add ecx, 0x74fd6c
call fcn.0041f8d0
mov ecx, dword [esi]
push eax
add ecx, 0x7491d8
call fcn.004136e0
push 8
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov eax, dword [esi]
cmp byte [eax + 0x74ff1c], bl
je 0x41e76b
lea edi, [esi + 0x83618]
mov byte [eax + 0x74ff1c], bl
mov ecx, edi
call fcn.00442c20
push 1
push 0x48d47c
mov ecx, edi
call fcn.00443c40
push 0x48d474
mov ecx, edi
call fcn.00442db0
mov ecx, dword [esi]
mov bx, ax
and ebx, 0xffff
add ecx, 0x18fb50
push ebx
push 0x48d468
call fcn.00446020
mov ecx, dword [esi]
push 0x62
add ecx, 0x208870
call fcn.004458e0
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
lea eax, [ebp - 0x41]
add ecx, 0x208870
push eax
call fcn.004458e0
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439b10
mov ecx, dword [esi]
add esp, 8
add ecx, 0x208870
push 0x61
call fcn.004458e0
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00439b10
mov eax, dword [esp + 0x18]
add esp, 8
mov ecx, edi
push eax
push ebx
call fcn.00442cb0
lea ecx, [esp + 0x10]
push ecx
jmp 0x41e906
lea edx, [edi - 0x96]
xor ecx, ecx
cmp edx, 5
ja case.default.0x41e778
jmp dword [edx*4 + 0x41effc]
mov cx, word [eax + 0x74fb78]
jmp case.default.0x41e778
mov cx, word [eax + 0x74fb7a]
jmp case.default.0x41e778
mov cx, word [eax + 0x74fb7c]
jmp case.default.0x41e778
mov cx, word [eax + 0x74fb7e]
jmp case.default.0x41e778
mov cx, word [eax + 0x74fb80]
jmp case.default.0x41e778
mov cx, word [eax + 0x74fb82]
movsx edx, cx
lea ecx, [eax + 0x74fd6c]
mov dword [esp + 0xfc], edx
call fcn.0041f920
cmp dword [esp + 0xfc], eax
ja 0x41e826
mov ecx, dword [esi]
add ebp, 0xffffff6a
push ebp
add ecx, 0x74fd6c
call fcn.0041f990
mov eax, dword [esp + 0xfc]
mov ecx, dword [esi]
neg eax
push eax
add ecx, 0x74fd6c
call fcn.0041f9e0
add edi, 0xffffff6b
mov ecx, dword [esi]
push edi
add ecx, 0x74fef4
call fcn.00428990
push 7
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov eax, dword [esi]
push 0x21
mov ecx, esi
mov byte [eax + 0x74ff1c], bl
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov eax, dword [esi]
cmp byte [eax + 0x74ff1c], bl
je 0x41e928
lea edi, [esi + 0x83618]
mov byte [eax + 0x74ff1c], bl
mov ecx, edi
call fcn.00442c20
push 1
push 0x48d47c
mov ecx, edi
call fcn.00443c40
push 0x48d474
mov ecx, edi
call fcn.00442db0
mov ecx, dword [esi]
mov bx, ax
and ebx, 0xffff
add ecx, 0x18fb50
push ebx
push 0x48d468
call fcn.00446020
mov ecx, dword [esi]
push 0x60
add ecx, 0x208870
call fcn.004458e0
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439930
mov ecx, dword [esi]
add esp, 8
lea edx, [ebp - 0x54]
add ecx, 0x208870
push edx
call fcn.004458e0
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439b10
mov ecx, dword [esi]
add esp, 8
add ecx, 0x208870
push 0x61
call fcn.004458e0
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x18]
add esp, 8
mov ecx, edi
push edx
push ebx
call fcn.00442cb0
lea eax, [esp + 0x10]
push eax
call fcn.00439990
add esp, 4
mov ecx, edi
push ebp
push 0x48da90
call fcn.00442c60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esp + 0x104]
xor ebp, ebp
add ecx, 0xffffff51
xor edi, edi
cmp ecx, 4
ja case.default.0x41e942
jmp dword [ecx*4 + 0x41f014]
mov ecx, dword [eax + 0x74ff24]
mov bp, word [eax + 0x74fb86]
test cl, 1
mov edi, 1
je 0x41e96c
mov bp, word [eax + 0x74fb90]
mov edi, 0x20
test cl, 0x20
je 0x41e97d
mov bp, word [eax + 0x74fb9a]
mov edi, 0x400
test ch, 4
je case.default.0x41e942
mov bp, word [eax + 0x74fba4]
mov edi, 0x8000
jmp case.default.0x41e942
mov ecx, dword [eax + 0x74ff24]
mov bp, word [eax + 0x74fb88]
test cl, 2
mov edi, 2
je 0x41e9ba
mov bp, word [eax + 0x74fb92]
mov edi, pe_nt_image_headers32
test cl, 0x40
je 0x41e9cb
mov bp, word [eax + 0x74fb9c]
mov edi, 0x800
test ch, 8
je case.default.0x41e942
mov bp, word [eax + 0x74fba6]
mov edi, 0x10000
jmp case.default.0x41e942
mov ecx, dword [eax + 0x74ff24]
mov bp, word [eax + 0x74fb8a]
test cl, 4
mov edi, 4
je 0x41ea08
mov bp, word [eax + 0x74fb94]
mov edi, 0x80
test cl, cl
jns 0x41ea18
mov bp, word [eax + 0x74fb9e]
mov edi, 0x1000
test ch, 0x10
je case.default.0x41e942
mov bp, word [eax + 0x74fba8]
mov edi, 0x20000
jmp case.default.0x41e942
mov ecx, dword [eax + 0x74ff24]
mov bp, word [eax + 0x74fb8c]
test cl, 8
mov edi, 8
je 0x41ea55
mov bp, word [eax + 0x74fb96]
mov edi, 0x100
test ch, 1
je 0x41ea66
mov bp, word [eax + 0x74fba0]
mov edi, 0x2000
test ch, 0x20
je case.default.0x41e942
mov bp, word [eax + 0x74fbaa]
mov edi, 0x40000
jmp case.default.0x41e942
mov ecx, dword [eax + 0x74ff24]
mov bp, word [eax + 0x74fb8e]
test cl, 0x10
mov edi, 0x10
je 0x41ea9c
mov bp, word [eax + 0x74fb98]
mov edi, 0x200
test ch, 2
je 0x41eaad
mov bp, word [eax + 0x74fba2]
mov edi, 0x4000
test ch, 0x40
je case.default.0x41e942
mov bp, word [eax + 0x74fbac]
mov edi, 0x80000
lea ecx, [eax + 0x74fd6c]
movsx ebp, bp
call fcn.0041f920
cmp ebp, eax
ja 0x41eb15
mov eax, dword [esi]
neg ebp
mov ebx, dword [eax + 0x74ff24]
push ebp
lea ecx, [eax + 0x74fd6c]
or edi, ebx
call fcn.0041f9e0
mov ecx, dword [esi]
push edi
add ecx, 0x74fef4
call fcn.00429160
push 7
mov ecx, esi
call fcn.004198f0
push 7
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov edx, dword [esi]
push 0x21
mov ecx, esi
mov byte [edx + 0x74ff1c], bl
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ebp, 0xffffff1f
push ebp
add ecx, 0x7491d8
call fcn.004136e0
push 8
mov ecx, esi
call fcn.004198f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
cmp eax, 0x12c
je 0x41eb85
cmp eax, 0x225
jle case.0x41ec12.607
cmp eax, 0x22b
jg case.0x41ec12.607
add edi, 0xfffffddb
jmp 0x41e802
push ebx
push 0x48d448
lea ecx, [esi + 0x83618]
call fcn.00443c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040fa00
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439930
lea ecx, [esp + 0x18]
push 0x48d438
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x20]
add esp, 0x10
push 1
push 0x498e60
push 0x498e60
push edx
push 0x48d87c
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov byte [eax + 0x684], bl
jmp 0x41edf0
sub eax, 0x259
cmp eax, 0x31
ja case.0x41ec12.607
xor edx, edx
mov dl, byte [eax + 0x41f044]
jmp dword [edx*4 + 0x41f028]
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040fa00
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439930
lea ecx, [esp + 0x18]
push 0x48d428
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x20]
add esp, 0x10
push 1
push 0x498e60
push 0x498e60
push edx
push 0x48d87c
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov byte [eax + 0x684], bl
jmp 0x41edf0
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040fa00
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00439930
lea eax, [esp + 0x18]
push 0x48d418
push eax
call fcn.00439b10
mov ecx, dword [esp + 0x20]
add esp, 0x10
push 1
push 0x498e60
push 0x498e60
push ecx
push 0x48d87c
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov edx, dword [esi]
lea eax, [esp + 0x10]
push eax
mov byte [edx + 0x684], bl
jmp 0x41edf0
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040fa00
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439930
push 0x48d408
jmp 0x41edb9
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040fa00
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00439930
lea ecx, [esp + 0x18]
push 0x48d3f8
push ecx
call fcn.00439b10
mov edx, dword [esp + 0x20]
add esp, 0x10
push 1
push 0x498e60
push 0x498e60
push edx
push 0x48d87c
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov eax, dword [esi]
lea ecx, [esp + 0x10]
push ecx
mov byte [eax + 0x684], bl
jmp 0x41edf0
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040fa00
lea edx, [esp + 0x10]
push eax
push edx
call fcn.00439930
lea eax, [esp + 0x18]
push 0x48d3e8
push eax
call fcn.00439b10
mov ecx, dword [esp + 0x20]
add esp, 0x10
push 1
push 0x498e60
push 0x498e60
push ecx
push 0x48d87c
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov edx, dword [esi]
lea eax, [esp + 0x10]
push eax
mov byte [edx + 0x684], bl
jmp 0x41edf0
mov ecx, dword [esi]
add ecx, 0x751b00
call fcn.0040fa00
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.00439930
push 0x48d3d8
lea edx, [esp + 0x1c]
push edx
call fcn.00439b10
mov eax, dword [esp + 0x20]
add esp, 0x10
push 1
push 0x498e60
push 0x498e60
push eax
push 0x48d87c
push ebx
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov ecx, dword [esi]
lea edx, [esp + 0x10]
mov byte [ecx + 0x684], bl
push edx
call fcn.00439990
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4