Function at 0x409775
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x46dac7
call fcn.00453e8c
sub esp, 0x138
push ebx
push esi
push edi
mov dword [ebp - 0x6c], ecx
call fcn.00401166
mov dword [ebp - 0x14], eax
mov eax, 0x4959d0
mov ecx, eax
mov edi, 0x4755e0
mov esi, 0x4755d8
mov dword [ebp - 0x98], edi
test ecx, ecx
mov dword [ebp - 0x78], esi
jne 0x4097b6
mov eax, 0x493568
xor ebx, ebx
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.004011a9
mov eax, dword [ebp - 0x90]
mov dword [ebp - 4], ebx
cmp eax, ebx
mov dword [ebp - 0x40], 0x4755fc
je 0x4097e0
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0xf]
push 1
push eax
push 0x489998
lea ecx, [ebp - 0xcc]
call fcn.00401889
mov eax, dword [eax + 8]
mov byte [ebp - 4], 1
cmp eax, ebx
jne 0x409806
mov eax, 0x4755fc
push dword [ebp - 0x40]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x9c], 0xd6
push 0x489964
push eax
call fcn.0040a587
add esp, 0xc
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], bl
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401093
mov eax, dword [ebp - 0x14]
push 0x4959d0
lea ecx, [eax + 0x18]
call fcn.00402936
lea eax, [ebp - 0xf]
push ebx
push eax
push 0x493568
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.004011a9
mov eax, dword [0x47565c]
mov dword [ebp - 4], 2
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x40988d
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x475654]
mov byte [ebp - 4], 3
cmp eax, ebx
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x78], esi
jne 0x4098b6
mov eax, 0x493568
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.004011a9
lea eax, [ebp - 0x3c]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x98]
push eax
push 5
mov byte [ebp - 4], 4
call fcn.0040a51e
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401093
mov ecx, dword [ebp - 0x14]
push 5
call fcn.0040a456
test al, al
jne 0x4099b5
mov eax, dword [0x47565c]
mov dword [ebp - 0x3c], edi
cmp eax, ebx
mov dword [ebp - 0x1c], esi
jne 0x409931
mov eax, 0x493568
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov esi, dword [ebp - 0x34]
mov dword [ebp - 4], 5
cmp esi, ebx
jne 0x409952
mov esi, 0x4755fc
lea eax, [ebp - 0xf]
push 1
push eax
push 0x489998
lea ecx, [ebp - 0xcc]
call fcn.00401889
mov eax, dword [eax + 8]
mov byte [ebp - 4], 6
cmp eax, ebx
jne 0x409978
mov eax, 0x4755fc
mov dword [ebp - 0xa0], eax
push esi
lea eax, [ebp - 0xa0]
push 0x4898f8
push eax
mov dword [ebp - 0x9c], 0xdf
call fcn.0040a587
add esp, 0xc
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 5
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
jmp 0x409a17
mov ecx, dword [ebp - 0x6c]
call fcn.0040a64e
test al, al
jne 0x409a23
lea eax, [ebp - 0xe]
push 1
push eax
push 0x489998
lea ecx, [ebp - 0xcc]
call fcn.00401889
mov eax, dword [eax + 8]
mov dword [ebp - 4], 7
cmp eax, ebx
jne 0x4099ea
mov eax, 0x4755fc
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xa0]
push 0x4898b4
push eax
mov dword [ebp - 0x9c], 0xe7
call fcn.0040a587
or dword [ebp - 4], 0xffffffff
pop ecx
pop ecx
lea ecx, [ebp - 0xcc]
call fcn.00401093
xor eax, eax
jmp 0x40a3ef
mov eax, dword [0x475660]
mov dword [ebp - 0x68], edi
cmp eax, ebx
mov dword [ebp - 0x48], esi
jne 0x409a37
mov eax, 0x493568
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x475664]
mov dword [ebp - 4], 8
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409a60
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov ecx, dword [ebp - 0x14]
push 0xa
lea eax, [ebp - 0x68]
push 0x1f40
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 9
call fcn.0042de60
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 8
mov dword [ecx + 0x40], eax
lea ecx, [ebp - 0x3c]
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
mov eax, dword [0x475670]
mov dword [ebp - 0x68], edi
cmp eax, ebx
mov dword [ebp - 0x48], esi
jne 0x409abb
mov eax, 0x493568
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x475654]
mov dword [ebp - 4], 0xa
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409ae4
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov ecx, dword [ebp - 0x14]
push 0xa
lea eax, [ebp - 0x68]
push 1
push eax
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 0xb
call fcn.0042de60
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 0xa
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
cmp dword [ebp - 0x40], 1
jne 0x409b5c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x268]
cmp byte [eax + 1], bl
jne 0x409b43
cmp byte [eax + 2], bl
jne 0x409b43
push 1
pop eax
jmp 0x409b45
xor eax, eax
cmp al, bl
sete al
cmp al, bl
je 0x409b57
mov dword [ecx + 0x38], 1
jmp 0x409b76
mov dword [ecx + 0x38], ebx
jmp 0x409b76
push 2
pop eax
cmp dword [ebp - 0x40], eax
jne 0x409b70
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x38], 1
jmp 0x409b76
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x38], eax
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x493568
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x78], esi
call fcn.004011a9
mov eax, dword [0x475678]
mov dword [ebp - 4], 0xc
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x409baf
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x475654]
mov byte [ebp - 4], 0xd
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409bd5
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
mov byte [ebp - 4], 0xe
call fcn.0040a51e
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xd
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xc
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401093
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x493568
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x78], esi
call fcn.004011a9
mov eax, dword [0x475674]
mov dword [ebp - 4], 0xf
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x409c60
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x475654]
mov byte [ebp - 4], 0x10
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409c86
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
push 2
mov byte [ebp - 4], 0x11
call fcn.0040a51e
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x10
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xf
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401093
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x493568
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x78], esi
call fcn.004011a9
mov eax, dword [0x47567c]
mov dword [ebp - 4], 0x12
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x409d11
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x475654]
mov byte [ebp - 4], 0x13
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409d37
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x98]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
push 3
mov byte [ebp - 4], 0x14
call fcn.0040a51e
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x13
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x12
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00401093
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xcc]
push 7
push eax
call fcn.0040a47b
cmp dword [eax + 0xc], ebx
lea ecx, [ebp - 0xcc]
sete byte [ebp - 0xd]
call fcn.00402424
cmp byte [ebp - 0xd], bl
je 0x409f6c
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x493568
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xac], esi
call fcn.004011a9
mov eax, dword [0x475668]
mov dword [ebp - 4], 0x15
cmp eax, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
jne 0x409df1
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x475654]
mov byte [ebp - 4], 0x16
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409e17
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0xcc]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
push 7
mov byte [ebp - 4], 0x17
call fcn.0040a51e
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x16
call fcn.00401093
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0x15
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.00401093
lea eax, [ebp - 0xe]
push ebx
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x98], 0x475628
mov dword [ebp - 0x78], 0x475620
call fcn.00403bf5
lea eax, [ebp - 0xa4]
push 0x400
push eax
lea ecx, [ebp - 0x98]
mov dword [ebp - 4], 0x18
call fcn.00402dad
mov ecx, dword [eax]
mov byte [ebp - 4], 0x19
mov byte [eax + 4], 1
call fcn.00403dc2
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x11c]
push 7
push eax
call fcn.0040a47b
mov eax, dword [eax + 8]
cmp eax, ebx
jne 0x409ed9
mov eax, 0x475650
push 0x400
push dword [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x11c]
call fcn.00402424
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x18
call fcn.00402ebf
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x98]
push ebx
push eax
push 7
call fcn.0040a3fe
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 5
je 0x409f5d
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x11c]
push 7
push eax
call fcn.0040a47b
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x1a
cmp eax, ebx
jne 0x409f3e
mov eax, 0x475650
mov ecx, dword [ebp - 0x14]
push 1
push eax
push 0x4898ac
call fcn.0042d267
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x18
call fcn.00402424
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.00402424
mov eax, 0x4898a8
mov dword [ebp - 0x68], edi
mov ecx, eax
mov dword [ebp - 0x48], esi
test ecx, ecx
jne 0x409f82
mov eax, 0x493568
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004011a9
mov eax, dword [0x475680]
mov dword [ebp - 4], 0x1b
cmp eax, ebx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
jne 0x409fab
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov eax, dword [0x475654]
mov byte [ebp - 4], 0x1c
cmp eax, ebx
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xac], esi
jne 0x409fd7
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.004011a9
lea eax, [ebp - 0x68]
mov ecx, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0x13
mov byte [ebp - 4], 0x1d
call fcn.0040a51e
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x1c
call fcn.00401093
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x1b
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], ebx
jne 0x40a0c7
mov eax, dword [0x47566c]
mov dword [ebp - 0x3c], edi
cmp eax, ebx
mov dword [ebp - 0x1c], esi
jne 0x40a04c
mov eax, 0x493568
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov eax, dword [0x475654]
mov dword [ebp - 4], 0x1e
cmp eax, ebx
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xac], esi
jne 0x40a07b
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.004011a9
mov ecx, dword [ebp - 0x14]
push 0xa
lea eax, [ebp - 0x3c]
push ebx
push eax
lea eax, [ebp - 0xcc]
push eax
mov byte [ebp - 4], 0x1f
call fcn.0042de60
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x1e
mov dword [ecx + 0x14], eax
lea ecx, [ebp - 0xcc]
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00401093
lea eax, [ebp - 0xe]
push ebx
push eax
push 0x493568
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], esi
call fcn.004011a9
mov eax, 0x48988c
mov dword [ebp - 4], 0x20
mov ecx, eax
mov dword [ebp - 0x3c], edi
test ecx, ecx
mov dword [ebp - 0x1c], esi
jne 0x40a0fc
mov eax, 0x493568
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
mov eax, dword [0x475654]
mov byte [ebp - 4], 0x21
cmp eax, ebx
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xac], esi
jne 0x40a128
mov eax, 0x493568
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.004011a9
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xcc]
push eax
push 0xd
mov ecx, esi
mov byte [ebp - 4], 0x22
call fcn.0040a51e
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0x21
call fcn.00401093
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x20
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401093
lea eax, [ebp - 0xf4]
push 0xd
push eax
mov ecx, esi
call fcn.0040a47b
cmp dword [ebp - 0xe8], 3
mov dword [ebp - 4], 0x23
jbe 0x40a3dd
mov eax, 0x489884
mov dword [ebp - 0x98], 0x475628
mov ecx, eax
mov dword [ebp - 0x78], 0x475620
test ecx, ecx
jne 0x40a1c4
mov eax, 0x493568
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.00403cfd
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x94]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x24
call fcn.0040b127
neg eax
sbb al, al
lea ecx, [ebp - 0x98]
inc al
mov byte [ebp - 4], 0x23
mov byte [ebp - 0xd], al
call fcn.00402424
cmp byte [ebp - 0xd], bl
je 0x40a21e
mov byte [esi + 0x4c], 1
jmp 0x40a36e
push 1
lea eax, [ebp - 0xe]
pop edi
lea ecx, [ebp - 0x3c]
push edi
push eax
push 0x48987c
call fcn.00402d75
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x38]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x25
call fcn.0040b127
test eax, eax
je 0x40a2ac
lea eax, [ebp - 0xf]
push edi
push eax
push 0x489870
lea ecx, [ebp - 0xcc]
call fcn.00402d75
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xc8]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x26
call fcn.0040b127
neg eax
sbb al, al
lea ecx, [ebp - 0xcc]
inc al
mov byte [ebp - 4], 0x25
mov byte [ebp - 0xd], al
call fcn.00402424
cmp byte [ebp - 0xd], bl
mov byte [ebp - 0xd], bl
je 0x40a2b0
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x23
call fcn.00402424
cmp byte [ebp - 0xd], bl
je 0x40a2ca
mov byte [esi + 0x4d], 1
jmp 0x40a36e
lea eax, [ebp - 0xe]
push edi
push eax
push 0x489868
lea ecx, [ebp - 0x3c]
call fcn.00402d75
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x38]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x27
call fcn.0040b127
test eax, eax
je 0x40a355
lea eax, [ebp - 0xf]
push edi
push eax
push 0x48985c
lea ecx, [ebp - 0xcc]
call fcn.00402d75
lea eax, [ebp - 0xcc]
lea ecx, [ebp - 0xc8]
neg eax
sbb eax, eax
push ebx
and eax, ecx
lea ecx, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x28
call fcn.0040b127
neg eax
sbb al, al
lea ecx, [ebp - 0xcc]
inc al
mov byte [ebp - 4], 0x27
mov byte [ebp - 0xd], al
call fcn.00402424
cmp byte [ebp - 0xd], bl
mov byte [ebp - 0xd], bl
je 0x40a359
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0x23
call fcn.00402424
cmp byte [ebp - 0xd], bl
je 0x40a36e
mov byte [esi + 0x4e], 1
lea eax, [ebp - 0x6e]
push 1
push eax
push 0x489838
lea ecx, [ebp - 0x11c]
call fcn.00401171
lea eax, [ebp - 0x6d]
push 1
push eax
lea ecx, [ebp - 0x144]
push dword [0x475654]
mov byte [ebp - 4], 0x29
call fcn.00401171
push 0xa
lea eax, [ebp - 0x11c]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x144]
mov ecx, esi
push eax
mov byte [ebp - 4], 0x2a
call fcn.0042de60
lea ecx, [ebp - 0x144]
mov dword [esi + 0x50], eax
mov byte [ebp - 4], 0x29
call fcn.00401093
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0x23
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.00402424
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret