Function at 0x411c62
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xcf0
mov ecx, dword [0x440aa4]
mov dword [esp + 0xd0], 0xdb1f33f6
mov dword [esp + 0xd4], 0
mov dword [esp + 0xd8], 0
mov byte [esp + 0xdc], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x28]
cmp eax, 0xc
ja 0x40ee0c
nop
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
movzx edx, byte [esp + edx + 0xd0]
lea esi, [eax + edx]
add esi, 0xfeca9c
add eax, 0xfeca9c
and eax, edx
add eax, eax
sub esi, eax
mov dword [esp + 0x2e0], esi
mov eax, dword [esp + 0x2e0]
add al, 0xbc
mov edx, dword [esp + 0x28]
mov byte [esp + edx + 0xd0], al
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, 0xd
jb 0x40edc0
mov edx, dword [str.H8NgCl__]
mov dword [esp + 0x2e0], 0xce96eaed
mov dword [esp + 0x2e4], 0x9ee1e496
mov dword [esp + 0x2e8], 0xa6d9e08e
mov dword [esp + 0x2ec], 0xdea9aedd
mov dword [esp + 0x2f0], 0xb9e8d8a7
mov dword [esp + 0x2f4], 0xe3fba7d5
mov dword [esp + 0x2f8], 0xb7f0e5e6
mov dword [esp + 0x2fc], 0x2fe3cdb1
mov byte [esp + 0x300], 0
mov dword [esp + 0x260], 0
mov eax, dword [esp + 0x260]
cmp eax, 0x20
ja 0x40eee2
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x260]
mov esi, dword [esp + 0x260]
movzx esi, byte [esp + esi + 0x2e0]
lea edi, [eax - 0x29cecb2a]
add eax, 0xd6
and eax, esi
or edi, esi
sub edi, eax
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x28]
add al, 0x26
mov esi, dword [esp + 0x260]
mov byte [esp + esi + 0x2e0], al
inc dword [esp + 0x260]
mov eax, dword [esp + 0x260]
cmp eax, 0x21
jb 0x40ee90
movzx ebx, byte [esp + 0x2e0]
lea eax, [esp + 0x260]
test bl, bl
je 0x40ef0b
lea esi, [esp + 0x2e1]
nop
nop
nop
nop
mov byte [eax], bl
inc eax
movzx ebx, byte [esi]
inc esi
test bl, bl
jne 0x40ef00
mov byte [eax], 0
movzx ebx, byte [edx]
test bl, bl
je 0x40ef2b
inc edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], bl
inc eax
movzx ebx, byte [edx]
inc edx
test bl, bl
jne 0x40ef20
mov byte [eax], 0
movzx edx, byte [esp + 0xd0]
test dl, dl
je 0x40ef5b
lea esi, [esp + 0xd1]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40ef50
mov byte [eax], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40ef7b
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax], dl
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40ef70
mov byte [eax], 0
lea ecx, [esp + 0x260]
mov dword [esp + 0x2e0], 0x1bad19db
mov dword [esp + 0x2e4], 0xe75ae552
mov dword [esp + 0x2e8], 0xe354e14d
mov dword [esp + 0x2ec], 0xef1bed50
mov dword [esp + 0x2f0], 0xeb53e934
mov dword [esp + 0x2f4], 0xf75bf544
mov dword [esp + 0x2f8], 0xf312f10a
mov dword [esp + 0x2fc], 0xff4efd5d
mov dword [esp + 0x300], 0xfb4ef948
mov dword [esp + 0x304], 0xc765c56d
mov dword [esp + 0x308], 0xc37ec161
mov dword [esp + 0x30c], 0xcf79cd65
mov dword [esp + 0x310], 0xcb3dc97e
mov dword [esp + 0x314], 0xd723d56c
mov dword [esp + 0x318], 0xd36dd16f
mov dword [esp + 0x31c], 0xdf2bdd63
mov dword [esp + 0x320], 0xdb6dd976
mov dword [esp + 0x324], 0xa713a516
mov dword [esp + 0x328], 0xa31fa155
mov dword [esp + 0x32c], 0xaf1aad1e
mov dword [esp + 0x330], 0xab1ca905
mov dword [esp + 0x334], 0xb701b517
mov dword [esp + 0x338], 0xb31fb11c
mov dword [esp + 0x33c], 0xbfabbd10
mov dword [esp + 0x340], 0xbbbab9b2
mov dword [esp + 0x344], 0
mov dword [esp + 0x28], 0
mov edx, dword [esp + 0x28]
cmp edx, 0x67
ja 0x40f108
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x28]
movzx esi, byte [esp + esi + 0x2e0]
lea edi, [edx - 0x2e528d84]
add edx, 0x7c
and edx, esi
or edi, esi
sub edi, edx
mov dword [esp + 0xd0], edi
mov edx, dword [esp + 0xd0]
add dl, 0x9c
mov esi, dword [esp + 0x28]
mov byte [esp + esi + 0x2e0], dl
inc dword [esp + 0x28]
mov edx, dword [esp + 0x28]
cmp edx, 0x68
jb 0x40f0c0
sub eax, ecx
mov dword [esp + 0xd0], 0x23432d1f
mov dword [esp + 0xd4], 0x275f2150
mov word [esp + 0xd8], 0x2524
mov dword [esp + 0xda], 0
mov dword [esp + 0xde], 0
mov byte [esp + 0xe2], 0
mov dword [esp + 0x1f8], 0
mov edx, dword [esp + 0x1f8]
cmp edx, 0x12
ja 0x40f1b1
nop
mov edx, dword [esp + 0x1f8]
mov esi, dword [esp + 0x1f8]
movzx esi, byte [esp + esi + 0xd0]
lea edi, [edx - 0x1775f9da]
add edx, 0x26
and edx, esi
or edi, esi
sub edi, edx
mov dword [esp + 0x28], edi
mov edx, dword [esp + 0x28]
add dl, 0xf6
mov esi, dword [esp + 0x1f8]
mov byte [esp + esi + 0xd0], dl
inc dword [esp + 0x1f8]
mov edx, dword [esp + 0x1f8]
cmp edx, 0x13
jb 0x40f160
lea edx, [esp + 0xc8]
lea esi, [esp + 0xb8]
lea edi, [esp + 0x2e0]
lea ebx, [esp + 0xd0]
push edx
push esi
push eax
push ecx
push edi
push ebx
push 0x446388
call fcn.0040c2d0
add esp, 0x1c
movzx eax, al
jmp dword [eax*4 + 0x441638]
xor esi, esi
xor ecx, ecx
test esi, esi
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x441640]
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp + 0xc8]
mov edi, dword [esp + 0xb8]
lea eax, [ecx + ecx*2]
shr eax, 2
movzx edx, byte [ecx + edi - 1]
cmp edx, 0x3d
je 0x40f22b
cmp edx, 0x2e
jne 0x40f22c
dec eax
movzx ecx, byte [ecx + edi - 2]
cmp ecx, 0x3d
je 0x40f23b
cmp ecx, 0x2e
jne 0x40f23c
dec eax
push eax
call fcn.00408a50
add esp, 4
mov esi, eax
push eax
push edi
call fcn.00433700
add esp, 8
push dword [esp + 0xb8]
call fcn.00436e70
add esp, 4
xor ecx, ecx
test esi, esi
sete cl
xor eax, eax
jmp dword [ecx*4 + 0x441640]
push esi
mov edi, ecx
call fcn.00401e80
add esp, 4
mov dword [esp + 0x24], eax
jmp dword [edi*4 + 0x441648]
push esi
call fcn.00408a60
add esp, 4
mov edi, dword [esp + 0x24]
push edi
call fcn.00402850
add esp, 4
mov esi, eax
mov word [esp + 0x2e0], 0xf8e6
mov byte [esp + 0x2e2], 0x6a
mov dword [esp + 0x2e3], 0
mov dword [esp + 0x2e7], 0
mov word [esp + 0x2eb], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x28]
cmp eax, 0xc
ja 0x40f339
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
movzx ecx, byte [esp + ecx + 0x2e0]
lea edx, [eax + 0xa5f8cd2]
add eax, 0xd2
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0xd0], edx
mov eax, dword [esp + 0xd0]
add al, 0x42
mov ecx, dword [esp + 0x28]
mov byte [esp + ecx + 0x2e0], al
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, 0xd
jb 0x40f2f0
lea eax, [esp + 0x2e0]
push eax
push esi
call fcn.004028c0
add esp, 8
xor ecx, ecx
test eax, eax
setg cl
jmp dword [ecx*4 + 0x441650]
xor eax, eax
movzx eax, al
jmp dword [eax*4 + 0x441658]
push edi
call fcn.00402ab0
add esp, 4
xor eax, eax
jmp 0x410224
mov edi, esi
mov dword [esp + 0x2e0], 0x73b4b5b6
mov dword [esp + 0x2e4], 0
mov dword [esp + 0x2e8], 0
mov word [esp + 0x2ec], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x28]
cmp eax, 0xd
ja 0x40f40f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
movzx ecx, byte [esp + ecx + 0x2e0]
lea edx, [eax + 0xe9]
and edx, ecx
mov esi, 0xc86f416
sub esi, eax
or esi, ecx
not esi
add esi, ecx
sub esi, edx
mov dword [esp + 0xd0], esi
mov eax, dword [esp + 0xd0]
add al, 0xa1
mov ecx, dword [esp + 0x28]
mov byte [esp + ecx + 0x2e0], al
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, 0xe
jb 0x40f3c0
push dword [esp + 0x2e0]
call fcn.00432c10
add esp, 4
movzx eax, al
mov esi, edi
mov edi, dword [esp + 0x24]
jmp dword [eax*4 + 0x441658]
mov word [esp + 0x2e0], 0xa1ad
mov byte [esp + 0x2e2], 0xa
mov dword [esp + 0x2e3], 0
mov word [esp + 0x2e7], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x28]
cmp eax, 8
ja 0x40f4b7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
movzx ecx, byte [esp + ecx + 0x2e0]
lea edx, [eax - 0x9457cd6]
add eax, 0x2a
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0xd0], edx
mov eax, dword [esp + 0xd0]
add al, 0xda
mov ecx, dword [esp + 0x28]
mov byte [esp + ecx + 0x2e0], al
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, 9
jb 0x40f470
lea eax, [esp + 0x2e0]
push eax
push esi
call fcn.004028c0
add esp, 8
mov dword [esp + 0xc0], eax
mov word [esp + 0x2e0], 0xe4eb
mov byte [esp + 0x2e2], 0x1a
mov dword [esp + 0x2e7], 0
mov dword [esp + 0x2e3], 0
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x28]
cmp eax, 0xa
ja 0x40f55a
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
movzx ecx, byte [esp + ecx + 0x2e0]
lea edx, [eax + ecx]
add eax, 0x54
and eax, ecx
add eax, eax
sub edx, eax
add edx, 0xb298f854
mov dword [esp + 0xd0], edx
mov eax, dword [esp + 0xd0]
add al, 0xb4
mov ecx, dword [esp + 0x28]
mov byte [esp + ecx + 0x2e0], al
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, 0xb
jb 0x40f510
lea eax, [esp + 0x2e0]
push eax
push esi
call fcn.004028c0
add esp, 8
xor ecx, ecx
test eax, eax
setg cl
mov dword [esp + 0xbc], ecx
mov dword [esp + 0x24], esi
push esi
call fcn.00410250
add esp, 4
push edi
call fcn.00402ab0
add esp, 4
lea edi, [esp + 0x1f8]
mov ecx, edi
push 1
call fcn.004093a0
push edi
call fcn.0041dd80
add esp, 4
mov ecx, edi
call fcn.00409d20
lea edi, [esp + 0xc80]
mov ecx, edi
push 3
call fcn.004093a0
push edi
call fcn.0041e6c0
add esp, 4
mov ecx, edi
call fcn.00409d20
lea edi, [esp + 0xc18]
mov ecx, edi
push 1
call fcn.004093a0
push edi
call fcn.0041eb50
add esp, 4
mov ecx, edi
call fcn.00409d20
lea edi, [esp + 0xbb0]
mov ecx, edi
push 1
call fcn.004093a0
push edi
call fcn.00420d70
add esp, 4
push edi
call fcn.00421710
add esp, 4
push edi
call fcn.00421bb0
add esp, 4
mov ecx, edi
call fcn.00409d20
lea edi, [esp + 0xb48]
mov ecx, edi
push 1
call fcn.004093a0
push edi
call fcn.00423cb0
add esp, 4
mov ecx, edi
call fcn.00409d20
lea edi, [esp + 0xae0]
mov ecx, edi
push 1
call fcn.004093a0
push edi
call fcn.00425c90
add esp, 4
push edi
call fcn.0042e170
add esp, 4
mov eax, dword [esp + 0xbc]
jmp dword [eax*4 + 0x441660]
push edi
call fcn.0042e350
add esp, 4
lea ecx, [esp + 0xae0]
call fcn.00409d20
lea eax, [esp + 0x1d7]
push eax
call fcn.00432fc0
add esp, 4
mov dword [esp], 0xaaa5a956
mov dword [esp + 4], 0x367890
mov dword [esp + 0xd0], 0
mov eax, dword [esp + 0xd0]
cmp eax, 7
ja 0x40f713
nop
nop
nop
nop
mov eax, dword [esp + 0xd0]
mov ecx, dword [esp + 0xd0]
movzx ecx, byte [esp + ecx]
lea edx, [eax + 8]
and edx, ecx
mov esi, 0x4c413af7
sub esi, eax
or esi, ecx
not esi
add esi, ecx
sub esi, edx
mov dword [esp + 0x2e0], esi
mov eax, dword [esp + 0x2e0]
add al, 0xc8
mov ecx, dword [esp + 0xd0]
mov byte [esp + ecx], al
inc dword [esp + 0xd0]
mov eax, dword [esp + 0xd0]
cmp eax, 8
jb 0x40f6c0
mov eax, dword [0x440aa4]
mov dword [esp + 0x28], 0x1bdfe326
mov dword [esp + 0x2c], 0
mov word [esp + 0x30], 0
mov dword [esp + 0xd0], 0
mov ecx, dword [esp + 0xd0]
cmp ecx, 9
ja 0x40f7b6
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xd0]
movzx edx, byte [esp + edx + 0x28]
lea esi, [ecx + 0x6fb21354]
and esi, edx
lea edi, [ecx + edx]
add edi, 0x6fb21354
add ecx, 0x54
and ecx, edx
add ecx, esi
mov edx, ecx
xor edx, edi
not ecx
and ecx, edi
add ecx, ecx
sub ecx, edx
mov dword [esp + 0x2e0], ecx
mov ecx, dword [esp + 0x2e0]
add cl, 0xb4
mov edx, dword [esp + 0xd0]
mov byte [esp + edx + 0x28], cl
inc dword [esp + 0xd0]
mov ecx, dword [esp + 0xd0]
cmp ecx, 0xa
jb 0x40f750
mov ecx, dword [str.H8NgCl__]
mov dword [esp + 0x2e0], 0x6e160a0d
mov dword [esp + 0x2e4], 0x412041b
mov dword [esp + 0x2e8], 0xc0d0019
mov dword [esp + 0x2ec], 0x451b0219
mov dword [esp + 0x2f0], 0x7e041836
mov dword [esp + 0x2f4], 0x4d464344
mov dword [esp + 0x2f8], 0x462e0c08
mov byte [esp + 0x2fc], 0x88
mov dword [esp + 0x2fd], 0
mov dword [esp + 0x301], 0
mov dword [esp + 0x304], 0
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
cmp edx, 0x27
ja 0x40f89d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x14]
movzx esi, byte [esp + esi + 0x2e0]
lea edi, [edx + 0xc6]
and edi, esi
add edx, esi
add edi, edi
sub edx, edi
add edx, 0x5c573bc6
mov dword [esp + 0xd0], edx
mov edx, dword [esp + 0xd0]
add dl, 0x96
mov esi, dword [esp + 0x14]
mov byte [esp + esi + 0x2e0], dl
inc dword [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp edx, 0x28
jb 0x40f850
movzx edx, byte [esp + 0x2e0]
test dl, dl
je 0x40f8cb
lea ebx, [esp + 0xd0]
lea esi, [esp + 0x2e1]
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], dl
inc ebx
movzx edx, byte [esi]
inc esi
test dl, dl
jne 0x40f8c0
mov byte [ebx], 0
movzx edx, byte [ecx]
test dl, dl
je 0x40f8eb
inc ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], dl
inc ebx
movzx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x40f8e0
mov byte [ebx], 0
movzx ecx, byte [esp + 0x28]
test cl, cl
je 0x40f90b
lea edx, [esp + 0x29]
nop
nop
nop
nop
nop
mov byte [ebx], cl
inc ebx
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x40f900
mov byte [ebx], 0
movzx ecx, byte [eax]
test cl, cl
je 0x40f92b
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], cl
inc ebx
movzx ecx, byte [eax]
inc eax
test cl, cl
jne 0x40f920
mov byte [ebx], 0
movzx eax, byte [esp]
test al, al
je 0x40f94b
lea ecx, [esp + 1]
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40f940
mov byte [ebx], 0
movzx eax, byte [esp + 0x1d7]
test al, al
je 0x40f97b
lea ecx, [esp + 0x1d8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [ebx], al
inc ebx
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x40f970
mov byte [ebx], 0
lea ecx, [esp + 0xd0]
mov edx, ebx
xor edx, ecx
not ecx
and ecx, ebx
add ecx, ecx
mov dword [esp + 0x2e0], 0x3910dcb
mov dword [esp + 0x2e4], 0x7920192
mov dword [esp + 0x2e8], 0x3ba805e1
mov dword [esp + 0x2ec], 0x3fe339ac
mov dword [esp + 0x2f0], 0x33bb3dc8
mov dword [esp + 0x2f4], 0x37d331a0
mov dword [esp + 0x2f8], 0x2b0a35fa
mov dword [esp + 0x2fc], 0x2fbe29c9
mov dword [esp + 0x300], 0x23be2dbc
mov dword [esp + 0x304], 0x27c121b9
mov dword [esp + 0x308], 0xdb4e25c5
mov dword [esp + 0x30c], 0xdf4dd941
mov dword [esp + 0x310], 0xd301dd4e
mov dword [esp + 0x314], 0xd70bd158
mov dword [esp + 0x318], 0xcb41d55f
mov dword [esp + 0x31c], 0xcf13c943
mov dword [esp + 0x320], 0xc351cd56
mov dword [esp + 0x324], 0xc75bc156
mov dword [esp + 0x328], 0xfb6fc519
mov dword [esp + 0x32c], 0xff62f96e
mov dword [esp + 0x330], 0xf360fd19
mov dword [esp + 0x334], 0xf765f117
mov dword [esp + 0x338], 0xeb0ff510
mov dword [esp + 0x33c], 0xefd3e90c
mov dword [esp + 0x340], 0xe3e2edd2
mov dword [esp + 0x348], 0
mov dword [esp + 0x344], 0
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 0x6b
ja 0x40fb11
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 0x2e0]
lea ebx, [esi + 0x56]
and ebx, edi
mov eax, 0x7cd25ea9
sub eax, esi
or eax, edi
not eax
add eax, edi
sub eax, ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
add al, 0xa6
mov esi, dword [esp]
mov byte [esp + esi + 0x2e0], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x6c
jb 0x40fad0
sub ecx, edx
mov dword [esp + 0x28], 0x6383614f
mov dword [esp + 0x2c], 0x678f65f4
mov word [esp + 0x30], 0x6968
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov dword [esp + 0x39], 0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
cmp eax, 0x14
ja 0x40fbac
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
movzx eax, byte [esp + eax + 0x28]
lea esi, [edx - 0x2d2dc850]
lea edi, [edx + 0xb0]
mov ebx, edi
and ebx, esi
and ebx, eax
xor edi, esi
and edi, eax
add eax, edx
add eax, 0xd2d237b0
lea edx, [edi + ebx*2]
sub eax, edx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0x30
mov edx, dword [esp + 0x14]
mov byte [esp + edx + 0x28], al
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 0x15
jb 0x40fb60
lea eax, [esp + 0xc4]
lea edx, [esp + 0xb4]
lea esi, [esp + 0x28]
push eax
push edx
push ecx
lea eax, [esp + 0xdc]
push eax
lea ebx, [esp + 0x2f0]
push ebx
push esi
push 0x446388
call fcn.0040c2d0
add esp, 0x1c
movzx eax, al
jmp dword [eax*4 + 0x441668]
xor esi, esi
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x441670]
mov ecx, dword [esp + 0xc4]
mov edi, dword [esp + 0xb4]
lea eax, [ecx + ecx*2]
shr eax, 2
movzx edx, byte [ecx + edi - 1]
cmp edx, 0x3d
je 0x40fc1c
cmp edx, 0x2e
jne 0x40fc1d
dec eax
movzx ecx, byte [ecx + edi - 2]
cmp ecx, 0x3d
je 0x40fc2c
cmp ecx, 0x2e
jne 0x40fc2d
dec eax
push eax
call fcn.00408a50
add esp, 4
mov esi, eax
push eax
push edi
call fcn.00433700
add esp, 8
push dword [esp + 0xb4]
call fcn.00436e70
add esp, 4
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x441670]
push esi
call fcn.00401e80
add esp, 4
mov edi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x441678]
push esi
call fcn.00408a60
add esp, 4
push edi
call fcn.004137c0
add esp, 4
push edi
call fcn.00402ab0
add esp, 4
mov dword [esp + 0x2e0], 0x6bf1f3f0
mov dword [esp + 0x2e4], 0
mov dword [esp + 0x2e7], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xa
ja 0x40fd1b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x2e0]
lea edx, [eax + ecx]
add edx, 0x9e020d2
add eax, 0xd2
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
add al, 0x42
mov ecx, dword [esp]
mov byte [esp + ecx + 0x2e0], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xb
jb 0x40fcd0
push ebx
push dword [esp + 0x28]
call fcn.004028c0
add esp, 8
xor ecx, ecx
test eax, eax
setg cl
jmp dword [ecx*4 + 0x441680]
lea ecx, [esp + 0x2e0]
push 1
call fcn.004093a0
mov eax, 0xffffffff
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax + 0x446691], 0
lea eax, [eax + 1]
jne 0x40fd50
mov dword [esp + 0x28], 0x76606484
mov dword [esp + 0x2c], 0x7f72ab63
mov word [esp + 0x30], 0xc97c
mov dword [esp + 0x32], 0
mov dword [esp + 0x36], 0
mov byte [esp + 0x3a], 0
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
cmp ecx, 0x12
ja 0x40fde5
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
movzx edx, byte [esp + edx + 0x28]
mov esi, ecx
and esi, 0xf206e2e0
xor ecx, 0xf206e2e0
lea ecx, [ecx + esi*2]
lea esi, [ecx + edx]
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp], esi
mov ecx, dword [esp]
add cl, 0xe0
mov edx, dword [esp + 0x14]
mov byte [esp + edx + 0x28], cl
inc dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x13
jb 0x40fda0
lea esi, [esp + 0x2e0]
mov ecx, esi
push eax
push 0x446690
lea eax, [esp + 0x30]
push eax
call fcn.004095a0
mov ecx, esi
call fcn.00409d20
lea ecx, [esp + 0x2e0]
call fcn.004093e0
mov eax, dword [case.0x40fd2f.5]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
xor eax, eax
cmp dword [esp + 0xc0], 0
setg al
jmp dword [eax*4 + 0x441698]
push 0
call fcn.0043a7b0
add esp, 4
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4416a0]
mov dword [esp + 0x28], 0xf39fcdab
mov dword [esp + 0x2c], 0xf7a4f194
mov dword [esp + 0x30], 0xfb62f591
mov dword [esp + 0x34], 0xffdef99d
mov dword [esp + 0x38], 0xe375fdda
mov dword [esp + 0x3c], 0xe787e174
mov dword [esp + 0x40], 0xeb7ee572
mov dword [esp + 0x44], 0xefbde9c8
mov dword [esp + 0x48], 0x137bed81
mov dword [esp + 0x4c], 0x17361182
mov dword [esp + 0x50], 0x1b771573
mov dword [esp + 0x54], 0x1f4c197c
mov dword [esp + 0x58], 0x39a1d79
mov dword [esp + 0x5c], 0x7260165
mov dword [esp + 0x60], 0xb590522
mov dword [esp + 0x64], 0xf2e096f
mov dword [esp + 0x68], 0x335b0d98
mov dword [esp + 0x6c], 0x3753315d
mov dword [esp + 0x70], 0x3baf35a7
mov dword [esp + 0x74], 0x3f1e39ac
mov dword [esp + 0x78], 0x23b63d6f
mov dword [esp + 0x7c], 0x27712100
mov dword [esp + 0x80], 0x2b792504
mov dword [esp + 0x84], 0x2fbd29ba
mov dword [esp + 0x88], 0x53c42d4a
mov dword [esp + 0x8c], 0x57375135
mov dword [esp + 0x90], 0x5b7a553b
mov dword [esp + 0x94], 0x5f7e5972
mov dword [esp + 0x98], 0x43275d38
mov dword [esp + 0x9c], 0x4766412c
mov dword [esp + 0xa0], 0x4b4a4562
mov byte [esp + 0xa8], 0
mov dword [esp + 0xa4], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x80
ja 0x40ffd9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x28]
lea esi, [ecx + 0x5c92d5e]
add ecx, 0x5e
and ecx, edx
or esi, edx
sub esi, ecx
mov dword [esp + 0x2e0], esi
mov ecx, dword [esp + 0x2e0]
mov edx, ecx
or edx, 0x6d
and ecx, 0x6d
add ecx, edx
inc cl
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x81
jb 0x40ff90
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x410001
lea ebx, [esp + 0x2e0]
lea edx, [esp + 0x2a]
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x40fff0
mov word [ebx], 0
movzx ecx, word [eax]
test cx, cx
je 0x410031
add eax, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx], cx
add ebx, 2
movzx ecx, word [eax]
add eax, 2
test cx, cx
jne 0x410020
mov dword [ebx], 0x220022
mov dword [ebx + 4], 0x22
mov dword [esp + 0x68], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x54], 1
push 0xd3a7a30
push dword [0x447690]
call fcn.0043a8f0
add esp, 8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x2e0]
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push edx
push 0
call eax
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0x4416a8]
mov eax, dword [esp + 0x14]
mov dword [esp], 0x62656467
mov dword [esp + 4], 0
mov dword [esp + 7], 0
mov dword [esp + 0x10], 0
mov ecx, dword [esp + 0x10]
cmp ecx, 0xa
ja 0x410190
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
movzx ecx, byte [esp + ecx]
mov esi, edx
and esi, 0x134974b1
xor edx, 0x934974b1
lea edx, [edx + esi*2]
mov esi, edx
not esi
and edx, ecx
or esi, ecx
not edx
add edx, ecx
sub edx, esi
mov dword [esp + 0xcc], edx
mov ecx, dword [esp + 0xcc]
add cl, 0x29
mov edx, dword [esp + 0x10]
mov byte [esp + edx], cl
inc dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp ecx, 0xb
jb 0x410140
mov ecx, dword [0x44769c]
test ecx, ecx
je case.0x40fd2f.6
mov edx, dword [esp]
xor esi, esi
mov edi, dword [0x4476a0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + esi*8], 0x11081610
je 0x4101c0
inc esi
cmp ecx, esi
jne 0x4101b0
jmp case.0x40fd2f.6
mov ecx, dword [edi + esi*8 + 4]
cmp ecx, edx
je case.0x40fd2f.6
push eax
push 1
push dword [0x4476a4]
push ecx
call fcn.00438e70
add esp, 0x10
lea ecx, [esp + 0xae0]
call fcn.004093e0
lea ecx, [esp + 0xb48]
call fcn.004093e0
lea ecx, [esp + 0xbb0]
call fcn.004093e0
lea ecx, [esp + 0xc18]
call fcn.004093e0
lea ecx, [esp + 0xc80]
call fcn.004093e0
lea ecx, [esp + 0x1f8]
call fcn.004093e0
mov al, 1
mov ecx, dword [case.0x40f269.1]
nop
nop
nop
nop
nop
nop
jmp ecx
mov ecx, dword [case.0x40fc58.22]
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jmp dword [0x4416e0]
xor ebx, ebx
mov dword [esp + 0x148], edi
jmp 0x41032f
mov ebx, dword [esp + 0x14c]
inc ebx
mov edi, dword [esp + 0x148]
push edi
call fcn.00402a70
add esp, 4
xor ecx, ecx
cmp ebx, eax
setb cl
mov al, 1
jmp dword [ecx*4 + 0x4416e8]
mov dword [esp + 0x14c], ebx
push ebx
push edi
call fcn.00402a80
add esp, 8
mov ebx, eax
mov word [esp + 0x58], 0xb124
mov dword [esp + 0x5a], 0
mov word [esp + 0x5e], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 7
ja 0x4103d3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
lea edx, [eax - 0x6fd23698]
add eax, 0x68
or eax, edx
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0xe0], edx
mov eax, dword [esp + 0xe0]
add al, 0x28
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 8
jb 0x410390
push 3
push esi
push ebx
call fcn.00402a20
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x4416f0]
mov word [esp + 0x58], 0xb104
mov dword [esp + 0x5a], 0
mov word [esp + 0x5e], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 7
ja 0x410461
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
lea edx, [eax - 0x2c2c3fe8]
add eax, 0x18
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0xe0], edx
mov eax, dword [esp + 0xe0]
add al, 0x58
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 8
jb 0x410420
push esi
push ebx
call fcn.00402820
add esp, 8
fnstcw word [esp + 0xd6]
movzx eax, word [esp + 0xd6]
or eax, 0xc00
mov word [esp + 0x13e], ax
fldcw word [esp + 0x13e]
fistp dword [esp + 0x160]
fldcw word [esp + 0xd6]
mov eax, dword [esp + 0x160]
xor ecx, ecx
cmp eax, 2
setl cl
jmp dword [ecx*4 + 0x4416f8]
xor ecx, ecx
cmp eax, 3
setl cl
jmp dword [ecx*4 + 0x441700]
sete al
movzx eax, al
jmp dword [eax*4 + 0x441708]
jmp dword [0x4417e4]
xor ecx, ecx
test eax, eax
setle cl
jmp dword [ecx*4 + 0x441710]
mov word [esp + 0x58], 0x51e6
mov dword [esp + 0x5a], 0
mov dword [esp + 0x5e], 0
mov dword [esp + 0x62], 0
mov byte [esp + 0x66], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xe
ja 0x4106ab
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
lea edx, [eax + 0x4b4fb1f3]
mov esi, ecx
not esi
or esi, edx
and edx, ecx
add edx, esi
neg edx
add eax, edx
add eax, 0x4b4fb1f2
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xe0]
add al, 0x5b
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xf
jb 0x410660
lea esi, [esp + 0x58]
push esi
push ebx
call fcn.004027d0
add esp, 8
mov edi, eax
mov word [esp + 0x58], 0x39cc
mov dword [esp + 0x5a], 0
mov dword [esp + 0x5e], 0
mov dword [esp + 0x62], 0
mov byte [esp + 0x66], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xe
ja 0x410742
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
mov edx, eax
and edx, 0xe4979977
xor eax, 0x64979977
lea eax, [eax + edx*2]
xor eax, ecx
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xe0]
mov ecx, eax
xor ecx, 0xbe
and eax, 0x3e
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xf
jb case.default.0x410753
push esi
push ebx
call fcn.004027d0
add esp, 8
xor ecx, ecx
test edi, edi
sete cl
jmp dword [ecx*4 + 0x441908]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x441910]
mov dword [esp + 0x1c], eax
mov ecx, eax
mov eax, edi
mov esi, eax
inc eax
cmp byte [esi], 0
jne 0x410770
mov dword [esp + 0x28], ecx
mov eax, esi
sub eax, edi
xor ebx, ebx
mov dword [esp + 0x3c], eax
test eax, eax
jle 0x4118e9
mov dword [esp + 0x24], edi
cmp byte [edi], 0
je 0x4118ed
xor ebx, ebx
mov edi, dword [esp + 0x24]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x58], 0
lea eax, [esp + 0x58]
push eax
push esi
push edi
call fcn.0040ebb0
add esp, 0xc
lea ecx, [edi + eax]
inc ebx
cmp ecx, esi
jae 0x4118ed
cmp byte [edi + eax], 0
mov edi, ecx
jne 0x4107b0
jmp 0x4118ed
mov word [esp + 0x58], 0x65f6
mov dword [esp + 0x5a], 0
mov dword [esp + 0x5d], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 8
ja 0x410862
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
add eax, 0x1b32c6f1
xor eax, ecx
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xe0]
mov ecx, eax
or ecx, 0x68
and eax, 0x68
add eax, ecx
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
mov eax, dword [esp + 8]
mov ecx, eax
and ecx, 1
xor eax, 1
lea eax, [eax + ecx*2]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp eax, 9
jb 0x410810
push esi
push ebx
call fcn.004027d0
add esp, 8
mov dword [esp + 0x1c], eax
mov word [esp + 0x58], 0xb530
mov dword [esp + 0x5a], 0
mov dword [esp + 0x5e], 0
mov dword [esp + 0x62], 0
mov byte [esp + 0x66], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xe
ja 0x410915
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx edx, byte [esp + ecx + 0x58]
lea ecx, [eax - 0x45cb6917]
mov esi, ecx
and esi, edx
xor ecx, edx
lea ecx, [ecx + esi*2]
add eax, 0xe9
and eax, edx
add eax, esi
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xe0]
mov ecx, eax
or ecx, 0xa0
and eax, 0xa0
add eax, ecx
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xf
jb 0x4108b0
lea esi, [esp + 0x58]
push esi
push ebx
call fcn.004027d0
add esp, 8
xor ecx, ecx
mov edx, dword [esp + 0x1c]
test edx, edx
sete cl
jmp dword [ecx*4 + 0x441978]
xor ecx, ecx
test eax, eax
sete cl
jmp dword [ecx*4 + 0x441980]
mov dword [esp + 0x2c], eax
mov eax, edx
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
inc eax
cmp byte [ebx], 0
jne 0x410950
mov eax, ebx
sub eax, edx
xor edi, edi
mov dword [esp + 0x24], eax
test eax, eax
jle 0x4109a7
cmp byte [edx], 0
je 0x4109a7
xor edi, edi
mov esi, dword [esp + 0x1c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x58], 0
lea eax, [esp + 0x58]
push eax
push ebx
push esi
call fcn.0040ebb0
add esp, 0xc
lea ecx, [esi + eax]
inc edi
cmp ecx, ebx
jae 0x4109a7
cmp byte [esi + eax], 0
mov esi, ecx
jne 0x410980
mov eax, edi
inc eax
lea eax, [edi + edi + 2]
jns 0x4109b5
mov eax, 0xffffffff
push eax
call fcn.00408a50
add esp, 4
mov dword [esp + 0x58], 0
lea ecx, [eax + edi*2]
mov edi, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ecx
cmp ecx, eax
mov esi, dword [esp + 0x1c]
jbe 0x410a1b
mov edi, dword [esp + 0x30]
cmp dword [esp + 0x24], 0
jle 0x410a1b
mov edi, dword [esp + 0x30]
nop
nop
nop
nop
nop
nop
cmp byte [esi], 0
je 0x410a1b
lea eax, [esp + 0x58]
push eax
push ebx
push esi
call fcn.0040ebb0
add esp, 0xc
movzx ecx, word [esp + 0x58]
mov word [edi], cx
add edi, 2
cmp edi, dword [esp + 0x28]
jae 0x410a1b
add esi, eax
cmp esi, ebx
jb 0x4109f0
mov word [edi], 0
mov edi, 0xfffffffe
xor eax, eax
mov ecx, dword [esp + 0x2c]
nop
nop
nop
nop
nop
add edi, 2
cmp byte [ecx + eax], 0
lea eax, [eax + 1]
jne 0x410a30
lea ebx, [eax - 1]
lea ecx, [edi + 2]
test eax, eax
jns 0x410a4b
mov ecx, 0xffffffff
push ecx
call fcn.00408a50
add esp, 4
mov dword [esp + 0x38], eax
cmp dword [esp + 0x2c], 0
jne 0x410a79
mov ebx, dword [esp + 0x2c]
not ebx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc ebx
cmp byte [eax], 0
lea eax, [eax + 1]
jne 0x410a70
mov dword [esp + 0x58], 0
mov eax, dword [esp + 0x38]
add edi, eax
mov esi, eax
cmp edi, eax
mov eax, dword [esp + 0x2c]
jbe 0x410ae1
mov esi, dword [esp + 0x38]
test ebx, ebx
jle 0x410ae1
mov ecx, eax
add ecx, ebx
mov esi, dword [esp + 0x38]
mov dword [esp + 0x1c], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [eax], 0
je 0x410ae1
mov ebx, eax
lea eax, [esp + 0x58]
push eax
push ecx
push ebx
call fcn.0040ebb0
add esp, 0xc
movzx ecx, word [esp + 0x58]
mov word [esi], cx
add esi, 2
cmp esi, edi
jae 0x410ae1
add ebx, eax
mov ecx, dword [esp + 0x1c]
cmp ebx, ecx
mov eax, ebx
jb 0x410ab0
mov word [esi], 0
mov word [esp + 0x58], 0xe5f9
mov byte [esp + 0x5a], 0x6a
mov dword [esp + 0x5f], 0
mov dword [esp + 0x5b], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xa
ja 0x410b66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
lea edx, [eax + ecx]
add edx, 0x89c0ddd2
add eax, 0x89c0ddd2
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xe0], edx
mov eax, dword [esp + 0xe0]
add al, 0x42
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xb
jb 0x410b20
lea esi, [esp + 0x58]
push esi
push dword [ebp + 8]
call fcn.00402870
add esp, 8
xor ecx, ecx
mov dword [esp + 0x34], eax
test eax, eax
setne cl
mov dword [esp + 0x24], 0
xor ebx, ebx
jmp dword [ecx*4 + 0x441988]
mov ecx, esi
push 3
call fcn.004093a0
push dword [esp + 0x24]
push ebx
push dword [esp + 0x40]
push dword [esp + 0x3c]
push esi
call fcn.004188b0
add esp, 0x14
mov ecx, esi
call fcn.00409d20
xor eax, eax
test ebx, ebx
sete al
jmp dword [eax*4 + 0x4419b8]
sete al
movzx eax, al
jmp dword [eax*4 + 0x441718]
mov word [esp + 0x58], 0x7996
mov dword [esp + 0x5a], 0
mov dword [esp + 0x5e], 0
mov word [esp + 0x62], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xb
ja 0x410caf
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
lea edx, [eax - 0x45e75f51]
lea esi, [eax + 0xaf]
or edx, esi
and esi, ecx
and edx, ecx
add edx, esi
add eax, ecx
add eax, 0xba18a0af
sub eax, edx
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xe0]
add al, 0x37
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xc
jb 0x410c60
push 2
lea esi, [esp + 0x5c]
push esi
push ebx
call fcn.00402a20
add esp, 0xc
xor ecx, ecx
test eax, eax
setne cl
mov al, 1
jmp dword [ecx*4 + 0x441720]
mov word [esp + 0xe0], 0x2db9
mov dword [esp + 0xe2], 0
mov dword [esp + 0xe6], 0
mov dword [esp + 0xea], 0
mov byte [esp + 0xee], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xe
ja 0x410d66
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0xe0]
lea edx, [eax + 0x5a]
and edx, ecx
mov esi, 0x2c58eaa5
sub esi, eax
or esi, ecx
not esi
add esi, ecx
sub esi, edx
mov dword [esp + 0x40], esi
mov eax, dword [esp + 0x40]
add al, 0x8a
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0xe0], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xf
jb 0x410d20
push 5
lea eax, [esp + 0xe4]
push eax
push ebx
call fcn.00402a20
add esp, 0xc
xor ecx, ecx
test eax, eax
setne cl
lea esi, [esp + 0x58]
mov al, 1
jmp dword [ecx*4 + 0x441728]
jmp dword [0x441734]
push dword [esp + 0x34]
call fcn.00402a70
add esp, 4
mov ecx, eax
mov dword [esp + 0x24], eax
mov ecx, 0xc
mul ecx
seto dl
mov ecx, 0xffffffff
mov esi, 0xffffffff
add eax, 4
jb 0x41155c
mov esi, eax
test dl, dl
jne 0x411562
mov ecx, esi
push ecx
call fcn.00408a50
add esp, 4
mov ebx, eax
mov ecx, dword [esp + 0x24]
mov dword [eax], ecx
add ebx, 4
xor eax, eax
test ecx, ecx
sete al
jmp dword [eax*4 + 0x441990]
mov edx, dword [case.0x410b8b.6]
mov eax, dword [esp + 0x24]
lea eax, [eax + eax*2]
lea eax, [ebx + eax*4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, ebx
jmp edx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
add ecx, 0xc
xor edx, edx
cmp ecx, eax
sete dl
jmp dword [edx*4 + 0x4419a8]
xor ecx, ecx
xor eax, eax
cmp ecx, dword [esp + 0x24]
setb al
lea esi, [esp + 0x58]
mov dword [esp + 0x3c], ebx
jmp dword [eax*4 + 0x4419b0]
mov dword [esp + 0x24], edi
mov eax, ebx
inc eax
lea eax, [ebx + ebx + 2]
jns 0x4118fb
mov eax, 0xffffffff
push eax
call fcn.00408a50
add esp, 4
mov ecx, ebx
and ecx, 1
xor ebx, 1
lea ecx, [ebx + ecx*2]
mov dword [esp + 0x58], 0
lea ecx, [eax + ecx*2]
add ecx, 0xfffffffe
mov ebx, eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x2c], ecx
cmp ecx, eax
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
jbe 0x411985
mov ebx, dword [esp + 0x34]
cmp dword [esp + 0x3c], 0
jle 0x411985
mov ebx, dword [esp + 0x34]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp byte [edi], 0
je 0x411985
lea eax, [esp + 0x58]
push eax
push esi
push edi
call fcn.0040ebb0
add esp, 0xc
movzx ecx, word [esp + 0x58]
mov word [ebx], cx
add ebx, 2
cmp ebx, dword [esp + 0x2c]
jae 0x411981
add edi, eax
cmp edi, esi
mov eax, dword [esp + 0x28]
jb 0x411950
jmp 0x411985
mov eax, dword [esp + 0x28]
mov word [ebx], 0
mov esi, 0xffffffff
nop
cmp byte [eax + esi + 1], 0
lea esi, [esi + 1]
jne 0x411990
add dword [esp + 0x1c], esi
xor edi, edi
mov dword [esp + 0x24], esi
test esi, esi
jle 0x4119eb
cmp byte [eax], 0
je 0x4119eb
xor edi, edi
mov ebx, dword [esp + 0x28]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [esp + 0x58], 0
lea eax, [esp + 0x58]
push eax
mov esi, dword [esp + 0x20]
push esi
push ebx
call fcn.0040ebb0
add esp, 0xc
lea ecx, [ebx + eax]
inc edi
cmp ecx, esi
jae 0x4119eb
cmp byte [ebx + eax], 0
mov ebx, ecx
jne 0x4119c0
mov eax, edi
inc eax
lea eax, [edi + edi + 2]
jns 0x4119f9
mov eax, 0xffffffff
push eax
call fcn.00408a50
add esp, 4
mov dword [esp + 0x58], 0
lea ecx, [eax + edi*2]
mov edi, eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x2c], ecx
cmp ecx, eax
mov ebx, dword [esp + 0x28]
jbe 0x411a5f
mov edi, dword [esp + 0x3c]
cmp dword [esp + 0x24], 0
jle 0x411a5f
mov edi, dword [esp + 0x3c]
nop
nop
cmp byte [ebx], 0
je 0x411a5f
lea eax, [esp + 0x58]
push eax
mov esi, dword [esp + 0x20]
push esi
push ebx
call fcn.0040ebb0
add esp, 0xc
movzx ecx, word [esp + 0x58]
mov word [edi], cx
add edi, 2
cmp edi, dword [esp + 0x2c]
jae 0x411a5f
add ebx, eax
cmp ebx, esi
jb 0x411a30
mov word [edi], 0
mov word [esp + 0x58], 0x7965
mov byte [esp + 0x5a], 2
mov dword [esp + 0x5b], 0
mov dword [esp + 0x5f], 0
mov word [esp + 0x63], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0xc
ja 0x411aef
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
lea edx, [eax + 0x80]
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
add eax, 0xeb23cf80
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xe0]
mov ecx, eax
or ecx, 0x7f
and eax, 0x7f
add eax, ecx
inc al
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0xd
jb 0x411aa0
lea eax, [esp + 0x58]
push eax
push dword [ebp + 8]
call fcn.00402870
add esp, 8
xor ecx, ecx
mov dword [esp + 0x2c], eax
test eax, eax
setne cl
mov dword [esp + 0x28], 0
xor edi, edi
jmp dword [ecx*4 + 0x441918]
lea esi, [esp + 0x58]
mov ecx, esi
push 2
call fcn.004093a0
push dword [esp + 0x28]
push edi
push dword [esp + 0x44]
push dword [esp + 0x40]
push esi
call fcn.00415c90
add esp, 0x14
mov ecx, esi
call fcn.00409d20
movzx eax, al
jmp dword [eax*4 + 0x441948]
mov eax, dword [esp + 0x5c]
mov byte [esp + 0x52], 0
cmp eax, 0x3ff
ja 0x411ea3
mov byte [esp + 0x51], 0x30
lea esi, [esp + 0x51]
jmp 0x411f2e
push dword [esp + 0x2c]
call fcn.00402a70
add esp, 4
mov ecx, eax
mov dword [esp + 0x28], eax
mov ecx, 0xc
mul ecx
seto dl
mov ecx, 0xffffffff
mov esi, 0xffffffff
add eax, 4
jb 0x411b9e
mov esi, eax
test dl, dl
jne 0x411ba4
mov ecx, esi
push ecx
call fcn.00408a50
add esp, 4
mov edi, eax
mov ecx, dword [esp + 0x28]
mov dword [eax], ecx
add edi, 4
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x24], edi
jmp dword [eax*4 + 0x441920]
mov eax, dword [esp + 0x28]
lea eax, [eax + eax*2]
lea eax, [edi + eax*4]
mov dword [edi], 0
mov dword [edi + 4], 0
mov byte [edi + 8], 0
lea ecx, [edi + 0xc]
xor edx, edx
cmp ecx, eax
sete dl
jmp dword [edx*4 + 0x441928]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov byte [ecx + 8], 0
add ecx, 0xc
xor edx, edx
cmp ecx, eax
sete dl
jmp dword [edx*4 + 0x441928]
xor esi, esi
jmp 0x411c5b
lea eax, [esp + 0x58]
push eax
push edi
call fcn.004028c0
add esp, 8
xor edx, edx
test eax, eax
setg dl
lea eax, [esi + esi*2]
mov edi, dword [esp + 0x24]
lea ecx, [edi + eax*4]
push edx
push dword [esp + 0x20]
push ebx
call fcn.004157a0
inc esi
mov eax, dword [case.0x411b14.9]
jmp eax
xor eax, eax
cmp esi, dword [esp + 0x28]
setb al
jmp dword [eax*4 + 0x441940]
push esi
push dword [esp + 0x30]
call fcn.00402a80
add esp, 8
mov edi, eax
mov word [esp + 0x58], 0x272d
mov byte [esp + 0x5a], 0xb4
lea eax, [esp + 0x5b]
mov word [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 8
ja 0x411d06
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx edx, byte [esp + ecx + 0x58]
lea ecx, [eax - 0x6e610c37]
mov ebx, ecx
and ebx, edx
xor ecx, edx
lea ecx, [ecx + ebx*2]
add eax, 0xc9
and eax, edx
add eax, ebx
mov edx, ecx
not edx
and edx, eax
not eax
and eax, ecx
sub eax, edx
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xe0]
add al, 0x81
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 9
jb 0x411cb0
lea eax, [esp + 0x58]
push eax
push edi
call fcn.004027d0
add esp, 8
mov dword [esp + 0x1c], eax
mov word [esp + 0x58], 0x3b55
mov byte [esp + 0x5a], 0xb2
lea eax, [esp + 0x5b]
mov word [eax + 4], 0
mov dword [eax], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 8
ja 0x411d91
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
lea edx, [eax - 0xa579098]
add eax, 0x68
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0xe0], edx
mov eax, dword [esp + 0xe0]
add al, 0x28
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 9
jb 0x411d50
lea eax, [esp + 0x58]
push eax
push edi
call fcn.004027d0
add esp, 8
mov ebx, eax
mov dword [esp + 0x58], 0x338a8982
lea eax, [esp + 0x5b]
mov byte [eax + 5], 0
mov dword [eax + 1], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 8
ja 0x411c30
nop
nop
nop
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x58]
lea edx, [eax + ecx]
add eax, 0x59
and eax, ecx
add eax, eax
sub edx, eax
add edx, 0x1a222559
mov dword [esp + 0xe0], edx
mov eax, dword [esp + 0xe0]
add al, 0x91
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x58], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 9
jb 0x411dd0
jmp 0x411c30
mov dword [esp + 0x24], edi
mov ecx, eax
shr ecx, 0xa
lea esi, [esp + 0x52]
cmp eax, 0x19000
jb 0x411f14
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
mov edx, 0x51eb851f
mul edx
shr edx, 5
imul edi, edx, 0x64
mov eax, ecx
sub eax, edi
mov edi, eax
and edi, 2
mov ebx, eax
or eax, 2
imul eax, edi
xor edi, 2
and ebx, 0x7d
imul ebx, edi
movzx eax, word [ebx + eax + 0x43e528]
mov word [esi - 2], ax
add esi, 0xfffffffe
cmp ecx, 0x270f
mov ecx, edx
ja 0x411ec0
cmp edx, 9
ja 0x411f1b
movzx eax, byte [edx + str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ]
mov byte [esi - 1], al
dec esi
jmp 0x411f2a
mov edx, ecx
cmp edx, 9
jbe 0x411f07
movzx eax, word [edx + edx + 0x43e528]
mov word [esi - 2], ax
add esi, 0xfffffffe
mov edi, dword [esp + 0x24]
mov dword [esp + 8], 0x9ba05b63
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0xc0], 0
mov eax, dword [esp + 0xc0]
cmp eax, 0xb
ja 0x411fb2
nop
nop
nop
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xc0]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x4bcc65c4]
add eax, 0xc4
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 0xe0], edx
mov eax, dword [esp + 0xe0]
add al, 0xa4
mov ecx, dword [esp + 0xc0]
mov byte [esp + ecx + 8], al
inc dword [esp + 0xc0]
mov eax, dword [esp + 0xc0]
cmp eax, 0xc
jb 0x411f60
mov dword [esp + 0xe0], 0x696a5eab
mov dword [esp + 0xe4], 0x1f536f6b
mov dword [esp + 0xe8], 0x6f6b5258
mov dword [esp + 0xec], 0x63145155
mov dword [esp + 0xf0], 0x4c7d0967
mov dword [esp + 0xf4], 0x4a0c4974
mov dword [esp + 0xf8], 0x7c717376
mov dword [esp + 0xfc], 0x77b7279
mov dword [esp + 0x100], 0x467d7a76
mov dword [esp + 0x104], 0x4b3c497d
mov dword [esp + 0x108], 0x4b44314f
mov dword [esp + 0x10c], 0x70413575
mov dword [esp + 0x110], 0x596f5f44
mov dword [esp + 0x114], 0x5e582d16
mov dword [esp + 0x118], 0x235c625a
mov dword [esp + 0x11c], 0x5a616652
mov dword [esp + 0x120], 0x2e582d61
mov dword [esp + 0x124], 0x751b3721
mov word [esp + 0x128], 0xb15e
mov dword [esp + 0x12e], 0
mov dword [esp + 0x12a], 0
mov dword [esp + 0x40], 0
mov eax, dword [esp + 0x40]
cmp eax, 0x51
ja 0x412107
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
movzx ecx, byte [esp + ecx + 0xe0]
lea edx, [eax + 0x7f]
and edx, ecx
add eax, ecx
add edx, edx
sub eax, edx
add eax, 0xfe85c27f
mov dword [esp + 0xc0], eax
mov eax, dword [esp + 0xc0]
mov ecx, eax
or ecx, 0x86
and eax, 0x86
add eax, ecx
inc al
mov ecx, dword [esp + 0x40]
mov byte [esp + ecx + 0xe0], al
inc dword [esp + 0x40]
mov eax, dword [esp + 0x40]
cmp eax, 0x52
jb 0x4120b0
lea eax, [0x44668f]
nop
nop
nop
cmp byte [eax + 1], 0
lea eax, [eax + 1]
jne 0x412110
movzx ecx, byte [esp + 0xe0]
test cl, cl
je 0x412142
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [eax + edx], cl
movzx ecx, byte [esp + edx + 0xe1]
inc edx
test cl, cl
jne 0x412130
add eax, edx
mov byte [eax], 0
movzx ecx, byte [esi]
test cl, cl
je 0x41215b
inc esi
nop
nop
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [esi]
inc esi
test cl, cl
jne 0x412150
mov byte [eax], 0
movzx ecx, byte [esp + 8]
test cl, cl
je 0x41217d
lea edx, [esp + 9]
lea esi, [esp + 0x58]
nop
mov byte [eax], cl
inc eax
movzx ecx, byte [edx]
inc edx
test cl, cl
jne 0x412170
jmp 0x412181
lea esi, [esp + 0x58]
mov byte [eax], 0
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x441950]
jmp dword [0x441764]
mov word [esp + 0xc0], 0xd0ec
mov byte [esp + 0xc2], 0x44
mov dword [esp + 0xc3], 0
mov dword [esp + 0xc7], 0
mov byte [esp + 0xcb], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xb
ja 0x4122f6
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0xc0]
lea edx, [eax + ecx]
add edx, 0xa14a0a75
add eax, 0xa14a0a75
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0x40]
add al, 0xcd
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0xc0], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xc
jb 0x4122b0
push 3
lea eax, [esp + 0xc4]
push eax
push ebx
call fcn.00402a20
add esp, 0xc
jmp case.0x40fc58.61
push 3
lea eax, [esp + 0xc4]
push eax
push ebx
call fcn.00402a20
add esp, 0xc
jmp dword [0x441768]
mov word [esp + 0xc0], 0xd0ec
mov byte [esp + 0xc2], 0x44
mov dword [esp + 0xc3], 0
mov dword [esp + 0xc7], 0
mov byte [esp + 0xcb], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xb
ja 0x412310
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0xc0]
lea edx, [eax + ecx]
add edx, 0xa14a0a75
add eax, 0xa14a0a75
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0x40]
add al, 0xcd
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0xc0], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xc
jb 0x412370
jmp 0x412310
mov eax, dword [0x4419ec]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov word [esp + 8], 0xc17a
mov dword [esp + 0xe], 0
mov dword [esp + 0xa], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 9
ja 0x412bcf
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x725050a0]
and edx, ecx
add eax, ecx
add eax, 0x725050a0
add edx, edx
sub eax, edx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
add al, 0xa0
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xa
jb 0x412b90
push 2
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.00402a20
add esp, 0xc
mov word [esp + 8], 0xc17a
mov dword [esp + 0xe], 0
mov dword [esp + 0xa], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 9
ja 0x412c4f
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + 0x725050a0]
and edx, ecx
add eax, ecx
add eax, 0x725050a0
add edx, edx
sub eax, edx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
add al, 0xa0
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xa
jb 0x412c10
push 2
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.00402a20
add esp, 0xc
jmp dword [0x441738]
xor ecx, ecx
test eax, eax
setne cl
mov al, 1
jmp dword [ecx*4 + 0x441740]
jmp dword [0x441748]
movzx eax, al
jmp dword [eax*4 + 0x441770]
mov word [esp + 0x48], 0x61c4
mov dword [esp + 0x4a], 0
mov dword [esp + 0x4e], 0
mov dword [esp + 0x52], 0
mov word [esp + 0x56], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xf
ja 0x41334e
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x48]
lea edx, [eax + ecx]
add eax, 0x50
and eax, ecx
add eax, eax
sub edx, eax
add edx, 0x1fa13050
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0x40]
add al, 0xd0
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x48], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x10
jb 0x413310
push 3
lea eax, [esp + 0x4c]
push eax
push ebx
call fcn.00402a20
add esp, 0xc
jmp dword [0x441750]
xor ecx, ecx
test eax, eax
setne cl
mov al, 1
jmp dword [ecx*4 + 0x441758]
mov word [esp + 0x48], 0x61c4
mov dword [esp + 0x4a], 0
mov dword [esp + 0x4e], 0
mov dword [esp + 0x52], 0
mov word [esp + 0x56], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xf
ja 0x4133ee
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x48]
lea edx, [eax + ecx]
add eax, 0x50
and eax, ecx
add eax, eax
sub edx, eax
add edx, 0x1fa13050
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0x40]
add al, 0xd0
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x48], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x10
jb 0x4133b0
push 3
lea eax, [esp + 0x4c]
push eax
push ebx
call fcn.00402a20
add esp, 0xc
jmp case.0x410d86.8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret