Function at 0x404280
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d23b4
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2ec54
call fcn.004c1320
mov eax, dword [0x4eb0b4]
xor eax, esp
mov dword [esp + 0x2ec50], eax
push ebx
push esi
push edi
mov eax, dword [0x4eb0b4]
xor eax, esp
push eax
lea eax, [esp + 0x2ec68]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, ecx
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x34], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x38], esi
cmp word [eax + 0x73b0], si
je 0x4042f4
mov dword [eax + 0x6160], esi
mov dword [eax + 0x6164], esi
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x1010], si
je 0x404360
push 0x4d7824
push edi
call fcn.00460840
test al, al
jne 0x404360
push 0x4d781c
push edi
call fcn.00460840
test al, al
jne 0x404360
push 0x4d7814
push edi
call fcn.00460840
test al, al
jne 0x40435a
mov eax, edi
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x404332
mov ecx, dword [0x4d7808]
mov dword [eax], ecx
mov edx, dword [0x4d780c]
mov dword [eax + 4], edx
mov cx, word [0x4d7810]
mov word [eax + 8], cx
push edi
call fcn.00461bc0
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6198], 0
je 0x404372
push edi
call fcn.0043d4b0
xor eax, eax
mov word [esp + 0x2d7dc], ax
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x6160]
xor ecx, ecx
or edx, dword [eax + 0x6164]
mov word [esp + 0x2dc5c], cx
je 0x4043a0
mov byte [ebx + 0x18f8], 1
jmp 0x4043a7
and dword [eax + 0x6148], 0xffffffe7
mov eax, dword [ebx + 0x38]
movzx ecx, byte [eax + 0x6189]
mov edx, dword [eax + 0x615c]
push 1
push ecx
push edx
add eax, 0xc41c
push eax
lea ecx, [esp + 0x297c4]
mov byte [esp + 0x26], 0
call fcn.00477f90
xor edi, edi
mov dword [esp + 0x2ec70], edi
mov eax, dword [esp + 0x34]
push 0x800
push eax
lea ecx, [esp + 0x2c7e0]
push ecx
call fcn.0047f480
mov eax, dword [ebx + 0x38]
lea ecx, [esp + 0x31cc]
mov dword [esp + 0x2d7d8], eax
call fcn.004072b0
lea ecx, [esp + 0x31d4]
call fcn.004072b0
lea ecx, [esp + 0x31dc]
call fcn.004072b0
mov edx, dword [ebx + 0x38]
push edx
lea ecx, [esp + 0xc8]
call fcn.00406f60
mov byte [esp + 0x2ec70], 1
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], di
lea esi, [eax + 0x73b0]
je 0x4044b2
push 0x50
lea eax, [esp + 0x58]
push edi
push eax
call fcn.004c1d50
add esp, 0xc
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], esi
mov dword [esp + 0x80], 2
mov dword [esp + 0x9c], 0xffffffff
call fcn.004072b0
lea ecx, [esp + 0x44]
call fcn.00482790
lea ecx, [esp + 0x44]
call fcn.00482770
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0xc8]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
call fcn.00406b00
mov edi, 1
jmp 0x40462d
lea edx, [esp + 0x21bc]
push edx
lea ecx, [esp + 0x297b8]
call fcn.00478830
test eax, eax
jne 0x40462d
or esi, 0xffffffff
mov eax, dword [esp + 0x130]
mov edx, dword [esp + 0x34]
push edi
push eax
lea ecx, [esp + 0x21c4]
push ecx
push edx
mov ecx, ebx
call fcn.00401580
test al, al
je 0x404611
push 0x50
lea eax, [esp + 0x58]
push 0
push eax
call fcn.004c1d50
mov eax, dword [esp + 0x31cc]
mov edx, dword [esp + 0x31c8]
lea ecx, [esp + 0x21c8]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x31d0]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x31d4]
or byte [esp + 0x22], ah
mov dword [esp + 0x70], ecx
add esp, 0xc
lea ecx, [esp + 0x31cc]
mov dword [esp + 0x5c], edx
mov byte [esp + 0xa0], al
mov byte [esp + 0xa1], ah
call fcn.00482770
lea ecx, [esp + 0x31dc]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
call fcn.00482770
mov ecx, dword [ebx + 0x38]
mov dword [esp + 0x78], edx
movzx edx, word [esp + 0x2c7d4]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x21bc]
push eax
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], 2
mov dword [esp + 0xa0], esi
call fcn.00420c10
test al, al
je 0x4045b1
or dword [esp + 0x94], 1
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xc48c], 0
jbe 0x4045f5
push 0x800
lea ecx, [esp + 0x1198]
push ecx
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.004016c0
mov eax, dword [esp + 0x31c8]
push 0
push 0
push eax
lea ecx, [esp + 0x11a0]
push ecx
mov ecx, dword [ebx + 0x38]
call fcn.004214f0
test al, al
jne 0x404611
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0xc8]
call fcn.00406b00
cmp byte [esp + 0x31c8], 0
jne 0x404611
inc edi
lea eax, [esp + 0x21bc]
push eax
lea ecx, [esp + 0x297b8]
call fcn.00478830
test eax, eax
je 0x4044d1
mov ecx, dword [esp + 0x130]
mov esi, dword [esp + 0x34]
push edi
push ecx
xor edi, edi
push edi
push edi
mov ecx, ebx
call fcn.00401580
cmp dword [esp + 0x2a7cc], edi
je 0x404687
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x62b2], 0
je 0x40467b
push 0x44c
call fcn.00475570
push eax
call fcn.004ad030
add esp, 4
push 6
mov ecx, 0x51ef08
call fcn.00433a60
jmp 0x404687
push 6
mov ecx, 0x51ef08
call fcn.00433940
lea ecx, [esp + 0xc4]
call fcn.00406fd0
mov eax, dword [ebx + 0x38]
push eax
lea ecx, [esp + 0xf160]
call fcn.0040e4b0
mov byte [esp + 0x2ec70], 2
mov ecx, dword [ebx + 0x38]
push ecx
lea ecx, [esp + 0x3208]
call fcn.0040e4b0
mov byte [esp + 0x2ec70], 3
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x5126], 0
je 0x4046df
cmp byte [eax + 0x5124], 0
je 0x4046df
mov ecx, 1
jmp 0x4046e1
xor ecx, ecx
mov byte [esp + 0xe118], cl
mov edx, dword [eax + 0x73ac]
mov ecx, dword [eax + 0x73a8]
push edx
mov edx, dword [eax + 0x73a4]
push ecx
push edx
lea ecx, [esp + 0x3210]
call fcn.0040bd50
mov eax, dword [ebx + 0x38]
movzx ecx, byte [eax + 0x6195]
neg ecx
sbb ecx, ecx
and ecx, 3
inc ecx
push ecx
push esi
lea ecx, [esp + 0xf164]
call fcn.0043b3e0
test al, al
je 0x404a4d
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x6160]
or edx, dword [eax + 0x6164]
jne 0x404766
cmp byte [esp + 0x1a068], dl
jne 0x404753
cmp dword [eax + 0x6148], edi
jne 0x404766
cmp byte [eax + 0x6197], 0
je 0x4047bb
cmp dword [esp + 0x1a064], 2
jne 0x4047bb
lea ecx, [esp + 0xf15c]
call fcn.0043bd20
cmp eax, 0x14
jne 0x404797
cmp edx, edi
jne 0x404797
lea ecx, [esp + 0xf15c]
call fcn.0043b6f0
mov dword [esp + 0x1017c], 1
jmp 0x404a5b
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x6160]
or ecx, dword [eax + 0x6164]
je 0x4047bb
mov dword [eax + 0x6160], edi
mov dword [eax + 0x6164], edi
mov byte [ebx + 0x18f8], 0
push edi
lea ecx, [esp + 0xf160]
call fcn.0040e710
lea ecx, [esp + 0xf15c]
call fcn.0040bc40
test al, al
jne 0x4047e3
push esi
mov ecx, 0x51ef08
call fcn.00433fe0
lea ecx, [esp + 0xf15c]
call fcn.004b32c0
push edi
lea ecx, [esp + 0xf160]
call fcn.0040baa0
test al, al
je 0x40480c
push 4
mov ecx, 0x51ef08
call fcn.00433a60
lea ecx, [esp + 0xf15c]
call fcn.0040bb60
test al, al
je 0x404828
push 3
mov ecx, 0x51ef08
call fcn.00433a60
mov dl, byte [esp + 0x1a068]
mov byte [esp + 0xe110], dl
push 1
push esi
push edi
call fcn.0040a520
cmp dword [esp + 0xf160], 0xffffffff
mov eax, dword [esp + 0x130]
setne byte [esp + 0x17]
xor esi, esi
xor edi, edi
mov byte [esp + 0x14], 0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edi
cmp eax, esi
jbe 0x404930
lea esp, [esp]
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
cmp dword [eax + 0x2c], 2
je 0x40489a
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
cmp dword [eax + 0x2c], 3
jne 0x40491c
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
mov ecx, dword [eax + 0xc]
cmp ecx, edi
jb 0x4048d0
ja 0x4048b9
mov edx, dword [eax + 8]
cmp edx, dword [esp + 0x2c]
jbe 0x4048d0
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
mov ecx, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov dword [esp + 0x2c], ecx
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
mov edx, dword [eax + 8]
add dword [esp + 0xe144], edx
mov eax, dword [eax + 0xc]
push esi
adc dword [esp + 0xe14c], eax
lea ecx, [esp + 0xc8]
call fcn.00406b50
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x3208]
call fcn.0040ba80
add dword [esp + 0xe14c], eax
adc dword [esp + 0xe150], 0
mov eax, dword [esp + 0x130]
inc esi
cmp esi, eax
jb 0x404870
mov dword [esp + 0x30], edi
cmp byte [esp + 0x17], 0
je 0x404b1e
test eax, eax
jne 0x40494e
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x62b2], al
je 0x404b78
lea ecx, [esp + 0x3204]
call fcn.0040bba0
push 0
push 1
lea eax, [esp + 0xf164]
push eax
lea ecx, [esp + 0x3210]
call fcn.004104d0
lea ecx, [esp + 0xe122]
push ecx
lea edx, [esp + 0x19]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xd0]
push ecx
lea edx, [esp + 0xf16c]
push edx
mov ecx, ebx
call fcn.00402630
cmp byte [esp + 0x15], 0
je 0x404b78
xor esi, esi
cmp dword [esp + 0x130], esi
jbe 0x4049e4
lea edi, [esi + 4]
jmp 0x4049c0
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
cmp dword [eax + 0x2c], edi
jne 0x404b74
inc esi
cmp esi, dword [esp + 0x130]
jb 0x4049c0
mov edi, dword [esp + 0x30]
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6180], 0
jne 0x404b78
push 0xa
mov ecx, 0x51ef08
call fcn.00433940
lea ecx, [esp + 0x3204]
call fcn.0043b6f0
mov byte [esp + 0x2ec70], 2
lea ecx, [esp + 0x3204]
call fcn.0040c260
mov byte [esp + 0x2ec70], 1
lea ecx, [esp + 0xf15c]
call fcn.0040c260
mov byte [esp + 0x2ec70], 0
lea ecx, [esp + 0xc4]
call fcn.004025c0
jmp 0x406602
cmp dword [esp + 0x1017c], 1
jne 0x404b01
push 1
push esi
lea ecx, [esp + 0x320c]
mov byte [esp + 0xe15c], 1
call fcn.0043bb20
mov edx, dword [ebx + 0x38]
cmp word [edx + 0x1010], di
je 0x404ae0
lea ecx, [esp + 0x1194]
call fcn.0043b3a0
mov byte [esp + 0x2ec70], 4
mov eax, dword [ebx + 0x38]
add eax, 0x1010
push eax
lea ecx, [esp + 0x1198]
call fcn.0043bae0
push 0x7fffffff
push 0x7fffffff
lea ecx, [esp + 0x320c]
push ecx
lea ecx, [esp + 0x11a0]
call fcn.0043bfe0
mov dword [esp + 0xe11c], eax
mov byte [esp + 0x2ec70], 3
lea ecx, [esp + 0x1194]
call fcn.0043bab0
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6148], edi
je 0x404afb
cmp dword [eax + 0x6134], edi
je 0x404afb
mov byte [esp + 0xe110], 1
push edi
jmp 0x404838
push esi
push edi
mov ecx, 0x51ef08
call fcn.00433e50
push 9
mov ecx, 0x51ef08
call fcn.00433a60
jmp 0x40483f
mov ecx, dword [ebx + 0x38]
xor edx, edx
cmp byte [ecx + 0x6197], dl
push 0
setne dl
push 0
lea eax, [esp + 0xf164]
push eax
lea ecx, [esp + 0x3210]
add edx, 2
mov dword [esp + 0xe118], edx
call fcn.004104d0
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x6160]
mov eax, dword [eax + 0x6164]
mov edx, ecx
or edx, eax
je 0x404b78
push eax
push ecx
lea eax, [esp + 0x320c]
push eax
call fcn.00492900
jmp 0x404b78
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0xe10c]
push ecx
mov ecx, dword [ebx + 0x38]
call fcn.00420e50
xor esi, esi
cmp dword [esp + 0x130], esi
jbe 0x404be3
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6153], 0
je 0x404bb2
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
cmp dword [eax + 0x2c], 2
je 0x404bc5
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
cmp dword [eax + 0x2c], 1
jne 0x404bd9
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
mov dword [eax + 0x2c], 0
inc esi
cmp esi, dword [esp + 0x130]
jb 0x404b93
mov esi, dword [ebx + 0x38]
cmp word [esi + 0x73b0], 0
jne 0x404c81
cmp byte [esp + 0x17], 0
je 0x404c05
cmp byte [esp + 0x1a068], 0
jne 0x404c81
cmp byte [esp + 0x16], 0
jne 0x404c81
mov eax, dword [esi + 0x6148]
test eax, eax
je 0x404c26
mov ecx, dword [esp + 0xe144]
mov edx, dword [esp + 0xe148]
jmp 0x404c2c
mov ecx, dword [esp + 0x2c]
mov edx, edi
neg eax
sbb eax, eax
and eax, 0xe0000
add eax, 0x20000
cmp dword [esi + 0xc], eax
jbe 0x404c81
push 0
push 2
push edx
push ecx
call fcn.004c1a70
mov edi, eax
lea esp, [esp]
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0xc]
xor esi, esi
cmp esi, edx
jb 0x404c81
ja 0x404c62
cmp eax, edi
jbe 0x404c81
shr dword [ecx + 0xc], 1
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0x6148]
neg eax
sbb eax, eax
and eax, 0xe0000
add eax, 0x20000
cmp dword [ecx + 0xc], eax
ja 0x404c50
cmp dword [esp + 0xe10c], 2
mov ecx, 0x400000
jne 0x404c9b
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xc], ecx
jbe 0x404c9b
mov dword [eax + 0xc], ecx
mov eax, dword [ebx + 0x38]
xor edi, edi
cmp dword [eax + 0x6134], edi
jne 0x404cb5
mov ecx, 0x20000
cmp dword [eax + 0xc], ecx
jbe 0x404cb5
mov dword [eax + 0xc], ecx
cmp byte [esp + 0xe110], 0
je 0x404ccf
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x617d], 0
jne 0x404ccf
mov al, 1
jmp 0x404cd1
xor al, al
push edi
push eax
lea ecx, [esp + 0xcc]
call fcn.00407270
mov edx, dword [ebx + 0x38]
cmp dword [edx + 0x61a0], edi
je 0x404d18
cmp dword [esp + 0xe10c], 3
jne 0x404d18
push 0x62c
call fcn.00475570
push eax
call fcn.0049ffb0
call fcn.004a06c0
lea eax, [esp + 0xc4]
push eax
mov ecx, ebx
call fcn.00402bb0
mov ecx, dword [ebx + 0x3c]
cmp ecx, edi
je 0x404d27
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp byte [esp + 0x17], 0
je 0x404d62
cmp dword [esp + 0x1a064], 3
je 0x404d6e
push 0x1b498
call fcn.004c22b0
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x2ec70], 6
cmp eax, edi
je 0x404d98
lea ecx, [ebx + 0x58]
push ecx
mov ecx, eax
call fcn.0045c740
jmp 0x404d9a
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x6197], 0
je 0x404d38
push 0x6228
call fcn.004c22b0
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x2ec70], 5
cmp eax, edi
je 0x404d98
lea edx, [ebx + 0x58]
push edx
mov ecx, eax
call fcn.00455d30
jmp 0x404d9a
xor eax, eax
mov byte [esp + 0x2ec70], 3
mov edx, dword [ebx + 0x38]
mov dword [ebx + 0x3c], eax
mov dword [edx + 0xa3c8], eax
lea eax, [ebx + 0x58]
push eax
lea ecx, [esp + 0x1b0b8]
call fcn.004903d0
mov byte [esp + 0x2ec70], 7
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax + 0x83b0]
mov edx, dword [edx + 0x20]
push eax
call edx
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x83b0]
cmp ecx, 8
jb 0x404ded
mov ecx, 8
mov dword [esp + 0x1b0d0], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov esi, eax
push eax
mov eax, dword [edx + 4]
call eax
test al, al
jne 0x404e36
mov edi, 0x100000
lea ecx, [ecx]
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xc], edi
jbe 0x404ed6
shr dword [eax + 0xc], 1
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
test al, al
je 0x404e10
xor edi, edi
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0xc]
cmp esi, eax
je 0x404e5b
shr eax, 0x14
push eax
shr esi, 0x14
push esi
push 0x663
call fcn.00475570
push eax
call fcn.004ad030
add esp, 0xc
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
lea esi, [ebx + 8]
push esi
call eax
cmp byte [esp + 0x1a068], 0
lea eax, [ebx + 0x58]
mov dword [esi + 0x24], ebx
mov ecx, dword [ebx + 0x38]
mov dword [esi + 0x2c], eax
lea edx, [esp + 0xf15c]
lea eax, [esp + 0x3204]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x20], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
je 0x404f2d
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x5124], 0
jne 0x404ec0
cmp byte [esp + 0x14], 0
je 0x404f0d
mov edx, dword [ebx + 0x48]
add dword [esp + 0xe144], edx
mov eax, dword [ebx + 0x4c]
adc dword [esp + 0xe148], eax
jmp 0x404f12
push 1
push section..data
lea ecx, [esp + 0x4c]
call fcn.004c139e
mov byte [esp + 0x2ec70], 8
mov dword [esp + 0x44], vtable.std::bad_alloc.0
mov byte [esp + 0x2ec70], 7
push 0x4e1f68
lea eax, [esp + 0x48]
push eax
call fcn.004c2213
mov byte [esp + 0x15], 1
push edi
lea ecx, [esp + 0xf160]
call fcn.00410a50
push edx
push eax
lea ecx, [esp + 0xf168]
call fcn.0040bdc0
xor esi, esi
mov dword [esp + 0x13c], esi
mov dword [esp + 0x140], edi
mov dword [esp + 0x144], edi
mov dword [esp + 0x148], edi
mov byte [esp + 0x2ec70], 9
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x130], edi
jbe 0x405da3
lea esp, [esp]
mov ecx, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0xc8]
call fcn.00406b50
mov ecx, 0x14
mov esi, eax
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x80], 0
je 0x405d86
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x90]
jmp 0x404fb0
mov eax, dword [esp + 0x80]
cmp eax, 6
je 0x4058be
cmp eax, 5
je 0x405a0b
cmp eax, 4
je 0x405a19
push 0
lea ecx, [esp + 0x96a8]
call fcn.004425b0
lea ecx, [esp + 0x115c]
call fcn.004072b0
lea ecx, [esp + 0x1164]
call fcn.004072b0
lea ecx, [esp + 0x116c]
call fcn.004072b0
lea ecx, [esp + 0x1194]
call fcn.0043b3a0
mov byte [esp + 0x2ec70], 0xb
cmp byte [esp + 0xa1], 0
je 0x405059
cmp dword [esp + 0xe10c], 3
jne 0x405059
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6189], 0
mov byte [esp + 0x13], 1
je 0x40505e
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x96a4]
push eax
push ecx
call fcn.00436bc0
cmp dword [esp + 0xa794], 0
jne 0x40505e
mov byte [esp + 0x13], 0
mov al, byte [esp + 0xa0]
test al, al
jne 0x405081
cmp byte [esp + 0x13], al
je 0x40507a
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6189], al
jne 0x405081
mov byte [esp + 0x28], 0
jmp 0x40509a
mov byte [esp + 0x28], 1
test al, al
je 0x40509a
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6158], 1
je 0x405d72
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], 0
jne 0x4050e7
movzx ecx, byte [eax + 0x6189]
mov eax, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x150]
push edx
push eax
call fcn.00441780
cmp byte [esp + 0xa0], 0
mov byte [esp + 0x13], al
je 0x4050f7
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x1174]
call fcn.00482780
jmp 0x4050f7
mov byte [esp + 0x13], 0
mov dword [esp + 0x11a0], 1
mov cl, byte [esp + 0x28]
test cl, cl
jne 0x40527e
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], 0
jne 0x40527e
cmp byte [esp + 0x13], cl
je 0x40513a
movzx eax, byte [eax + 0x6195]
mov ecx, dword [esp + 0x54]
neg eax
sbb eax, eax
and eax, 4
push eax
push ecx
lea ecx, [esp + 0x119c]
call fcn.0043b3e0
cmp dword [esp + 0x1198], 0xffffffff
jne 0x4051db
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x34]
push edx
push eax
mov ecx, 0x51ef08
call fcn.00433e20
mov ecx, dword [esp + 0x5c]
sub dword [esp + 0xe144], ecx
mov edx, dword [esp + 0x60]
push edi
sbb dword [esp + 0xe14c], edx
lea ecx, [esp + 0xc8]
call fcn.00406b50
inc dword [esp + 0x20]
mov dword [eax + 0x2c], 0
test esi, esi
jl 0x405d72
jg 0x4051a2
cmp dword [esp + 0x8c], 0
jbe 0x405d72
cmp dword [esp + 0x98], 0
jne 0x405d72
mov dword [esp + 0x80], 4
mov dword [ebx + 0x40], 0
mov byte [esp + 0x2ec70], 9
lea ecx, [esp + 0x1194]
call fcn.0043bab0
jmp 0x404fb0
cmp byte [esp + 0x13], 0
je 0x4051f6
lea ecx, [esp + 0x115c]
call fcn.00482770
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
cmp byte [esp + 0xa1], 0
jne 0x40529c
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x618a], 0
je 0x40529c
cmp dword [esp + 0xe10c], 3
jne 0x40529c
lea ecx, [esp + 0xa4]
push ecx
lea edx, [esp + 0x140]
push edx
lea eax, [esp + 0x119c]
push eax
mov ecx, ebx
mov dword [esp + 0xb0], edi
call fcn.00402970
test al, al
je 0x40529c
mov edx, dword [esp + 0xa4]
push 0x800
lea ecx, [esp + 0xa79c]
push ecx
push edx
lea ecx, [esp + 0xd0]
mov dword [esp + 0xa7a0], 4
call fcn.00406b50
push eax
mov eax, dword [ebx + 0x38]
push eax
jmp 0x405307
cmp byte [esp + 0xa1], 0
jne 0x405298
xor eax, eax
mov dword [esp + 0x114c], eax
mov dword [esp + 0x1150], eax
test cl, cl
jne 0x405311
cmp dword [esp + 0x9c], 0xffffffff
je 0x405311
cmp dword [esp + 0x1198], 0xffffffff
je 0x4052bc
lea ecx, [esp + 0x1194]
call fcn.0043b690
mov esi, dword [esp + 0x9c]
push esi
lea ecx, [esp + 0xc8]
call fcn.00406b50
mov eax, dword [eax + 0x2c]
cmp eax, 2
je 0x4052dd
cmp eax, 3
jne 0x405311
push 0x800
lea ecx, [esp + 0xa79c]
push ecx
push esi
lea ecx, [esp + 0xd0]
mov dword [esp + 0xa7a0], 5
call fcn.00406b50
mov edx, dword [ebx + 0x38]
push eax
push edx
call fcn.004016c0
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x54]
push eax
push 1
mov ecx, 0x51ef18
call fcn.004210a0
mov eax, dword [ebx + 0x38]
push 0x800
lea ecx, [esp + 0x96c8]
push ecx
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.004016c0
cmp byte [esp + 0x16], 0
je 0x4053ac
lea ecx, [esp + 0xf15c]
call fcn.0040be00
push 0
lea ecx, [esp + 0xf160]
mov esi, eax
mov edi, edx
call fcn.00410a50
push edx
push eax
lea ecx, [esp + 0xf168]
call fcn.0040bdc0
push 0
lea ecx, [esp + 0x1b0b8]
push ecx
push edi
push esi
lea edx, [esp + 0xf16c]
push edx
mov ecx, ebx
call fcn.00402380
mov edx, dword [ebx + 0x38]
mov edx, dword [edx + 0x6134]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
dec edx
push edx
lea edx, [esp + 0x1b0b8]
push edx
call eax
mov byte [ebx + 0x54], 1
xor edi, edi
cmp byte [esp + 0xe110], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x15], 0
je 0x4054db
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x6148]
mov byte [esp + 0x14], 0
test cl, 2
je 0x4053f9
mov esi, dword [eax + 0x614c]
cmp esi, edi
jle 0x4053f9
cmp dword [esp + 0x18], edi
jle 0x4053f9
mov eax, dword [esp + 0x18]
cdq
idiv esi
test edx, edx
jne 0x4053f9
mov byte [esp + 0x14], 1
test cl, 4
je 0x405444
lea ecx, [esp + 0x96c4]
push ecx
call fcn.00460820
mov esi, eax
cmp esi, edi
je 0x40543a
lea edx, [esp + 0x2d7dc]
push edx
push esi
call fcn.0047f430
test eax, eax
je 0x405428
mov byte [esp + 0x14], 1
push 0x40
push esi
lea eax, [esp + 0x2d7e4]
push eax
call fcn.0047f480
jmp 0x405444
xor ecx, ecx
mov word [esp + 0x2d7dc], cx
mov edx, dword [ebx + 0x38]
mov edx, dword [edx + 0x6148]
test dl, 8
jne 0x4054a6
lea ecx, [esp + 0x3222]
lea eax, [esp + 0x2dc5c]
mov si, word [eax]
cmp si, word [ecx]
jne 0x405486
cmp si, di
je 0x405482
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x405486
add eax, 4
add ecx, 4
cmp si, di
jne 0x405460
xor eax, eax
jmp 0x40548b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x4054a6
test dl, 0x10
jne 0x4054ad
cmp dword [esp + 0x30], edi
jg 0x4054ad
jl 0x4054a6
cmp dword [esp + 0x2c], 0x400000
ja 0x4054ad
cmp byte [esp + 0x14], 0
je 0x4054cb
cmp dword [esp + 0x18], edi
jle 0x4054cb
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov byte [ebx + 0x54], 0
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
jmp 0x4054db
mov eax, dword [esp + 0x5c]
add dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x60]
adc dword [esp + 0x30], ecx
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [esp + eax + 0x3222]
mov word [esp + eax + 0x2dc5c], cx
add eax, 2
cmp cx, di
jne 0x4054e0
mov eax, dword [esp + 0x80]
cmp eax, 2
jne 0x40550e
mov edx, dword [esp + 0x54]
push edi
push edi
push edi
push edx
jmp 0x40551c
cmp eax, 3
jne 0x405522
mov eax, dword [esp + 0x54]
push edi
push edi
push 1
push eax
push edi
call fcn.0040a560
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], di
jne 0x40553e
mov ecx, dword [esp + 0x115c]
or ecx, dword [esp + 0x1160]
jne 0x405550
mov dword [esp + 0x114c], edi
mov dword [esp + 0x1150], 0x100
cmp dword [esp + 0xe10c], 3
mov edx, dword [esp + 0x114c]
mov ecx, dword [esp + 0x1150]
mov dword [esp + 0x96a8], 2
mov dword [esp + 0xa6f4], edx
mov dword [esp + 0xa6f8], ecx
mov dword [esp + 0xa6ec], edi
mov dword [esp + 0xa6f0], edi
jne 0x405597
mov edi, dword [eax + 0x6138]
jmp 0x40559c
mov edi, 2
push edi
lea ecx, [esp + 0xa708]
call fcn.00442100
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x5124], 0
je 0x405659
cmp byte [esp + 0xa0], 0
jne 0x405659
mov esi, dword [esp + 0xe10c]
cmp esi, 3
jne 0x40560f
push 0x10
lea eax, [esp + 0xa749]
push eax
call fcn.00429fd0
mov esi, dword [esp + 0xe10c]
xor ecx, ecx
cmp byte [esp + 0xe118], cl
mov dword [esp + 0xa780], 0xf
sete cl
mov byte [esp + 0xa755], 1
mov byte [esp + 0xa75e], cl
mov edx, dword [esp + 0xe122]
mov eax, dword [esp + 0xe126]
mov ecx, dword [esp + 0xe12a]
mov dword [esp + 0xa735], edx
mov edx, dword [esp + 0xe12e]
mov byte [esp + 0xa72f], 1
mov byte [esp + 0xa734], 1
mov dword [esp + 0xa739], eax
mov dword [esp + 0xa73d], ecx
mov dword [esp + 0xa741], edx
jmp 0x405660
mov esi, dword [esp + 0xe10c]
mov eax, esi
sub eax, 3
neg eax
sbb eax, eax
and eax, 0x1d
cmp byte [ebx + 0x54], 0
mov byte [esp + 0x96bd], al
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0xa788], ecx
mov byte [esp + 0xa785], 0
je 0x405696
mov byte [esp + 0xa784], 1
cmp byte [esp + 0x13], 0
je 0x4056f5
mov edx, dword [esp + 0x115c]
mov ecx, dword [esp + 0x1160]
mov dword [esp + 0xa6d4], edx
mov edx, dword [esp + 0x116c]
mov dword [esp + 0xa6d8], ecx
mov ecx, dword [esp + 0x1170]
mov dword [esp + 0xa6e4], edx
mov edx, dword [esp + 0x1164]
mov dword [esp + 0xa6e8], ecx
mov ecx, dword [esp + 0x1168]
mov dword [esp + 0xa6dc], edx
mov dword [esp + 0xa6e0], ecx
xor edx, edx
jmp 0x405721
xor edx, edx
mov dword [esp + 0xa6d4], edx
mov dword [esp + 0xa6d8], edx
mov dword [esp + 0xa6e4], edx
mov dword [esp + 0xa6e8], edx
mov dword [esp + 0xa6dc], edx
mov dword [esp + 0xa6e0], edx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x96c0], ecx
cmp esi, 2
je 0x40573a
cmp dword [esp + 0xa794], edx
jne 0x405747
and ecx, 0xfffffbff
mov dword [esp + 0x96c0], ecx
cmp dword [esp + 0xa6f8], edx
movzx ecx, byte [esp + 0xa0]
mov byte [esp + 0xa785], cl
movzx ecx, byte [eax + 0x6134]
mov byte [esp + 0x96be], cl
jg 0x40578a
jl 0x40577c
cmp dword [esp + 0xa6f4], 0x80000000
ja 0x40578a
cmp word [eax + 0x73b0], dx
jne 0x40578a
cmp esi, 3
jne 0x405792
mov byte [esp + 0xa78d], 1
mov edx, dword [eax + 0x83b0]
push edx
push edi
lea ecx, [ebx + 0x24ac]
call fcn.00442230
lea eax, [esp + 0x3204]
push eax
lea ecx, [esp + 0x1198]
push ecx
lea esi, [ebx + 0x58]
mov ecx, esi
mov dword [esp + 0xa798], 0
call fcn.00467d40
xor eax, eax
mov dword [ebx + 0x1908], eax
mov dword [ebx + 0x190c], eax
mov eax, dword [esp + 0x114c]
mov dword [esp + 0xa6fc], eax
mov edx, dword [esp + 0x1150]
xor edi, edi
cmp byte [esp + 0x28], 0
mov byte [ebx + 0xa8], 1
mov dword [esp + 0xa700], edx
jne 0x405c35
mov ecx, dword [ebx + 0x38]
cmp word [ecx + 0x73b0], di
jne 0x405c35
lea edx, [esp + 0x3e]
push edx
lea eax, [esp + 0x43]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00467c60
cmp byte [esp + 0x3f], 0
je 0x405b49
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x34]
push edx
push eax
mov ecx, 0x51ef08
call fcn.00433e20
mov ecx, dword [esp + 0x5c]
sub dword [esp + 0xe144], ecx
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x60]
sbb dword [esp + 0xe148], edx
push eax
lea ecx, [esp + 0xc8]
call fcn.00406b50
inc dword [esp + 0x20]
cmp dword [esp + 0x90], edi
mov dword [eax + 0x2c], edi
jl 0x405d72
jg 0x405897
cmp dword [esp + 0x8c], edi
jbe 0x405d72
mov dword [esp + 0x80], 4
mov dword [ebx + 0x40], edi
mov byte [esp + 0x2ec70], 9
lea ecx, [esp + 0x1194]
call fcn.0043bab0
jmp 0x404f9c
mov edx, dword [esp + 0xf15c]
mov eax, dword [edx + 0xc]
lea ecx, [esp + 0xf15c]
mov dword [esp + 0xac], ecx
call eax
mov esi, eax
mov edi, edx
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], edi
mov byte [esp + 0x2ec70], 0xa
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0x8c]
push 0
push ecx
push edx
lea ecx, [esp + 0xf168]
call fcn.0040bdc0
lea ecx, [esp + 0xf15c]
call fcn.004132d0
mov eax, dword [esp + 0x148d0]
cmp eax, 2
je 0x405991
cmp eax, 3
je 0x40599a
mov al, byte [esp + 0x1a070]
cmp al, byte [esp + 0xe118]
jne 0x4059e7
mov ecx, dword [esp + 0x1a058]
mov edx, dword [esp + 0x1a054]
push 0
push ecx
push edx
lea ecx, [esp + 0xf168]
call fcn.0040bdc0
mov eax, dword [esp + 0x1a05c]
sub eax, dword [esp + 0x1a054]
mov ecx, dword [esp + 0x1a060]
sbb ecx, dword [esp + 0x1a058]
lea edx, [esp + 0x3204]
push ecx
push eax
push edx
jmp 0x4059db
lea ecx, [esp + 0x155fc]
jmp 0x4059a1
lea ecx, [esp + 0x1793c]
push 0
push 0
push ecx
push eax
lea ecx, [esp + 0x3214]
call fcn.0040e800
lea ecx, [esp + 0xf15c]
call fcn.0040be00
mov ecx, dword [esp + 0x1a05c]
sub ecx, eax
mov eax, dword [esp + 0x1a060]
sbb eax, edx
push eax
push ecx
lea ecx, [esp + 0x320c]
push ecx
lea ecx, [esp + 0xf168]
call fcn.0043bfe0
mov byte [esp + 0x2ec70], 9
mov edx, dword [esp + 0xf15c]
mov eax, dword [edx + 8]
push 0
push edi
push esi
lea ecx, [esp + 0xf168]
call eax
jmp 0x405d86
inc dword [esp + 0x38]
call fcn.00480080
jmp 0x405d86
cmp byte [esp + 0x1a068], 0
je 0x405a83
cmp byte [esp + 0x15], 0
jne 0x405a83
mov edx, dword [esp + 0x8c]
push 0
lea ecx, [esp + 0x1b0b8]
push ecx
push esi
push edx
lea eax, [esp + 0xf16c]
push eax
mov ecx, ebx
call fcn.00402380
mov ecx, dword [esp + 0x98]
mov eax, dword [ebx + 0x3c]
push ecx
push 0
lea edx, [esp + 0x1b0bc]
push edx
push eax
lea ecx, [esp + 0x3214]
push ecx
lea edx, [esp + 0xf170]
push edx
mov ecx, ebx
call fcn.00403840
call fcn.00480080
jmp 0x405d86
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov eax, dword [esp + 0x8c]
push 0
push esi
push eax
lea ecx, [esp + 0xf168]
call fcn.0040bdc0
lea ecx, [esp + 0xf15c]
call fcn.004132d0
lea ecx, [esp + 0x155fc]
push ecx
lea ecx, [esp + 0x96a8]
call fcn.00442690
mov eax, dword [esp + 0x98]
test eax, eax
je 0x405adf
push eax
lea edx, [esp + 0x96a8]
push edx
mov ecx, ebx
call fcn.004017d0
lea ecx, [esp + 0xf15c]
call fcn.00410970
test al, al
jne 0x405afa
mov al, byte [esp + 0x1a068]
mov byte [esp + 0x16], al
cmp byte [esp + 0x16], 0
je 0x405b17
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0xc]
cmp eax, dword [esp + 0xa788]
jbe 0x405b17
mov dword [esp + 0xa788], eax
push 0
push 0
push 0
push 2
lea ecx, [esp + 0x3214]
call fcn.0040e800
lea edx, [esp + 0xf15c]
push edx
lea ecx, [esp + 0x3208]
call fcn.0040bbf0
call fcn.00480080
jmp 0x405d86
cmp byte [esp + 0x3e], 0
je 0x405b9e
mov ecx, dword [esp + 0x1150]
mov edx, dword [esp + 0x24]
xor eax, eax
cmp ecx, eax
mov eax, dword [esp + 0x114c]
ja 0x405b86
jb 0x405b6e
cmp eax, edx
jae 0x405b86
mov byte [esp + 0x40], 1
mov edx, dword [esp + 0x40]
push edx
push 1
push ecx
push eax
call fcn.00401870
jmp 0x405c27
mov byte [esp + 0x40], 0
mov edx, dword [esp + 0x40]
push edx
push 1
push ecx
push eax
call fcn.00401870
jmp 0x405c27
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov esi, ecx
push esi
mov dword [esp + 0x1150], eax
mov edi, eax
add eax, 0x200
mov dword [esp + 0x1154], ecx
push 2
adc ecx, ecx
push ecx
push eax
call fcn.004c1a70
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
cmp edx, esi
ja 0x405be5
jb 0x405bd9
cmp eax, edi
jae 0x405be5
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x40000000
mov edi, dword [esp + 0x44]
mov esi, 1
xor eax, eax
mov edx, esi
add edx, 0xffffffff
mov ecx, eax
adc ecx, 0xffffffff
cmp dword [esp + 0x48], ecx
jb 0x405c19
ja 0x405c06
cmp edi, edx
jb 0x405c19
shld eax, esi, 7
shl esi, 7
mov edx, esi
or edx, eax
jne 0x405bf0
mov edx, dword [esp + 0x48]
jmp 0x405c23
add esi, 0xffffffff
adc eax, 0xffffffff
mov edi, esi
mov edx, eax
mov eax, edi
xor edi, edi
mov dword [esp + 0xa6fc], eax
mov dword [esp + 0xa700], edx
mov ecx, dword [esp + 0xe10c]
inc dword [esp + 0x18]
cmp ecx, 3
jne 0x405c51
mov dword [ebx + 0x1930], eax
mov dword [ebx + 0x1934], edx
test byte [esp + 0x94], 1
jne 0x405c6a
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6134], edi
je 0x405c6a
xor al, al
jmp 0x405c6c
mov al, 1
cmp byte [esp + 0x28], 0
mov byte [esp + 0x14], al
jne 0x405c7b
test al, al
je 0x405ca0
mov edx, dword [ebx + 0x38]
mov byte [esp + 0x96be], 0
cmp byte [edx + 0x5124], 0
jne 0x405c9c
cmp ecx, 3
je 0x405c9c
mov byte [esp + 0x96bd], 0x14
test al, al
jne 0x405ccc
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
xor ecx, ecx
add eax, dword [esp + 0xa6f4]
adc ecx, dword [esp + 0xa6f8]
mov dword [esp + 0xa8], ecx
js 0x405cd6
jg 0x405ccc
cmp eax, 0x8000
jbe 0x405cd6
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x54]
mov eax, dword [ebx + 0x3c]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x11a4]
push ecx
lea esi, [ebx + 8]
mov ecx, esi
call fcn.00403620
cmp byte [esp + 0x28], 0
jne 0x405d56
cmp byte [esp + 0x14], 0
je 0x405d27
push edi
mov ecx, esi
call fcn.004036e0
lea eax, [ebx + 0x58]
push eax
call fcn.004028c0
push edi
mov ecx, esi
call fcn.004030f0
mov dword [esi + 8], edi
mov dword [esi + 4], edi
jmp 0x405d56
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea esi, [eax + 0x62dc]
mov eax, dword [eax + 0x6134]
push esi
dec eax
push eax
movzx eax, byte [ebx + 0x54]
push eax
call edx
cmp byte [esp + 0xe110], 0
je 0x405d60
mov byte [ebx + 0x54], 1
cmp byte [esp + 0xe110], 0
jne 0x405d6a
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
call fcn.00480080
mov dword [ebx + 0x28], edi
mov byte [esp + 0x2ec70], 9
lea ecx, [esp + 0x1194]
call fcn.0043bab0
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x130]
jb 0x404f70
mov esi, dword [esp + 0x13c]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
cmp dword [esp + 0x20], 0
mov eax, dword [ebx + 0x38]
mov dword [eax + 0xa3c8], 0
jle 0x405dcd
push 6
mov ecx, 0x51ef08
call fcn.00433940
cmp dword [esp + 0x18], 0
jne 0x405e6d
cmp dword [esp + 0x38], 0
jne 0x405e6d
push 0xa
mov ecx, 0x51ef08
call fcn.00433940
lea ecx, [esp + 0x3204]
call fcn.0043b6f0
mov byte [esp + 0x2ec70], 7
test esi, esi
je 0x405e10
push esi
call fcn.004c1aa4
add esp, 4
mov byte [esp + 0x2ec70], 3
lea ecx, [esp + 0x1b0b4]
call fcn.0048d670
mov byte [esp + 0x2ec70], 2
lea ecx, [esp + 0x3204]
call fcn.0040c260
mov byte [esp + 0x2ec70], 1
lea ecx, [esp + 0xf15c]
call fcn.0040c260
mov byte [esp + 0x2ec70], 0xc
mov eax, dword [esp + 0x120]
test eax, eax
je 0x405e68
push eax
call fcn.004c1aa4
add esp, 4
jmp 0x4065e6
cmp byte [esp + 0x17], 0
je 0x405e8a
lea ecx, [esp + 0xf15c]
push ecx
lea ecx, [esp + 0x3208]
call fcn.0040f3d0
jmp 0x405e9a
push 0
push 0
lea ecx, [esp + 0x320c]
call fcn.0040fa00
mov byte [esp + 0x2ec70], 7
test esi, esi
je 0x405eaf
push esi
call fcn.004c1aa4
add esp, 4
mov byte [esp + 0x2ec70], 3
lea ecx, [esp + 0x1b0b4]
call fcn.0048d670
lea edx, [esp + 0x3222]
push edx
push 0
mov ecx, 0x51ef18
call fcn.004210a0
mov eax, dword [ebx + 0x38]
movzx esi, word [eax + 0x639c]
add eax, 0x639c
test si, si
je 0x405f15
xor ecx, ecx
cmp si, 0x40
sete cl
lea edx, [esp + 0x3222]
dec ecx
and eax, ecx
push eax
push edx
call fcn.00480370
test al, al
jne 0x405f15
push 2
mov ecx, 0x51ef08
call fcn.00433a60
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x6150], 0
je 0x40604d
push 0x33e
call fcn.00475570
push eax
call fcn.0049ffb0
call fcn.004a06c0
cmp dword [esp + 0x130], 0
mov dword [esp + 0x38], 0
jbe 0x40604d
mov ecx, dword [esp + 0x38]
push ecx
lea ecx, [esp + 0xc8]
call fcn.00406b50
mov esi, eax
mov ecx, 0x14
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x80]
cmp eax, 2
je 0x405f83
cmp eax, 3
jne 0x406037
lea ecx, [esp + 0x115c]
call fcn.004072b0
lea ecx, [esp + 0x1164]
call fcn.004072b0
lea ecx, [esp + 0x116c]
call fcn.004072b0
mov esi, dword [esp + 0x54]
push 0
lea edx, [esp + 0x150]
push edx
push esi
call fcn.00441780
test al, al
je 0x406037
lea ecx, [esp + 0x115c]
call fcn.00482770
cmp eax, dword [esp + 0x6c]
jne 0x406037
cmp edx, dword [esp + 0x70]
jne 0x406037
mov eax, dword [esp + 0x114c]
cmp eax, dword [esp + 0x5c]
jne 0x406037
mov ecx, dword [esp + 0x1150]
cmp ecx, dword [esp + 0x60]
jne 0x406037
cmp byte [esp + 0xa0], 0
jne 0x406037
mov edx, dword [esp + 0x64]
and edx, 0xffffffdf
push edx
push esi
call fcn.0043c640
test al, al
jne 0x40602a
push esi
push 0x4bf
call fcn.00475570
push eax
mov eax, dword [esp + 0x3c]
push eax
call fcn.004ad680
add esp, 0xc
push esi
push 0
call fcn.004a00a0
call fcn.004a06c0
mov eax, dword [esp + 0x38]
inc eax
mov dword [esp + 0x38], eax
cmp eax, dword [esp + 0x130]
jb 0x405f50
cmp word [esp + 0xe156], 0
lea eax, [esp + 0xe156]
jne 0x406066
lea eax, [esp + 0x3222]
mov ecx, dword [ebx + 0x38]
push 0x800
push eax
add ecx, 0xb41a
push ecx
mov dword [esp + 0x24], eax
call fcn.0047f480
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x62d9], 0
je 0x4062fc
mov ecx, dword [0x532b4c]
push 0x200
lea eax, [esp + 0x2d860]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [esp + 0x18]
push edx
push 0x54
call fcn.004a0b20
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x4060c4
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
push 0xc5e8
mov dword [ebx + 0x3c], 0
call fcn.004c22b0
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x2ec70], 0xf
test eax, eax
je 0x4060f1
mov ecx, eax
call fcn.00421970
jmp 0x4060f3
xor eax, eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x2ec70], 3
mov byte [eax + 0x62d9], 1
mov ecx, dword [ebx + 0x38]
mov edx, dword [ecx + 0x83b0]
mov dword [eax + 0x83b0], edx
mov dword [eax + 0x739c], 1
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6144]
mov byte [eax + 0x6144], dl
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6152]
mov byte [eax + 0x6152], dl
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6195]
mov byte [eax + 0x6195], dl
mov ecx, 0x4d7804
sub eax, ecx
lea edx, [eax + 0xa3fa]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x406160
mov esi, dword [ebx + 0x38]
mov edi, dword [esp + 0x1c]
add esi, 0x5024
add edi, 0x5024
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x15], al
mov eax, dword [esp + 0x18]
push eax
movsw word es:[edi], word [esi]
call fcn.0043ccc0
mov esi, dword [esp + 0x18]
test al, al
jne 0x4061e0
mov edi, 0x2e
jmp 0x4061b0
mov ecx, dword [ebx + 0x38]
cmp word [ecx + 0x639c], di
je 0x4061db
push esi
call fcn.00492330
test al, al
sete al
mov byte [esp + 0x15], al
cmp al, 1
je 0x4061e0
push esi
call fcn.0043ccc0
test al, al
je 0x4061b0
jmp 0x4061e0
mov byte [esp + 0x15], 1
cmp byte [esp + 0x15], 0
mov byte [esp + 0x14], 0
jne 0x406286
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0xa3dc], 0
jne 0x406201
call fcn.004a0480
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.00420cc0
push 0x4d7800
lea ecx, [esi + 0xc41c]
call fcn.0047fa40
mov eax, dword [0x51ef0c]
push 0x5c48
mov dword [esp + 0x28], eax
call fcn.004c22b0
add esp, 4
mov dword [esp + 0x40], eax
mov byte [esp + 0x2ec70], 0x10
test eax, eax
je 0x40624f
push esi
mov ecx, eax
call fcn.004393d0
mov edi, eax
jmp 0x406251
xor edi, edi
mov byte [esp + 0x2ec70], 3
push esi
mov ecx, edi
call fcn.0043ab40
test edi, edi
je 0x406275
mov ecx, edi
call fcn.004394b0
push edi
call fcn.004c1842
add esp, 4
mov ecx, dword [esp + 0x24]
cmp ecx, dword [0x51ef0c]
setne byte [esp + 0x14]
jmp 0x40628a
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.00401b60
push esi
call fcn.004c1842
add esp, 4
lea edx, [esp + 0x2d85c]
push edx
call fcn.0049ff40
call fcn.004a06c0
cmp byte [esp + 0x14], 0
je 0x4062fc
mov byte [esp + 0x2ec70], 2
lea ecx, [esp + 0x3204]
call fcn.0040c260
mov byte [esp + 0x2ec70], 1
lea ecx, [esp + 0xf15c]
call fcn.0040c260
mov byte [esp + 0x2ec70], 0x11
mov eax, dword [esp + 0x120]
test eax, eax
je 0x4062f7
push eax
call fcn.004c1aa4
add esp, 4
jmp 0x4065e6
mov eax, dword [ebp + 0x10]
cmp word [eax], 0x4d
je 0x406315
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x6196], 0
je 0x40657e
push 0x33f
call fcn.00475570
push eax
call fcn.0049ffb0
push 1
push 0
lea ecx, [esp + 0xcc]
call fcn.00407270
mov esi, dword [esp + 0x130]
or edi, 0xffffffff
lea ecx, [esp + 0xac]
dec esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x24], edi
call fcn.0043da00
mov byte [esp + 0x2ec70], 0x14
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x619a], 0
mov byte [esp + 0x15], 0
je 0x4063ac
call fcn.004215e0
test al, al
jne 0x4063ac
cmp dword [esp + 0x20], 0
jne 0x4063ac
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x6153], 0
jne 0x4063ac
cmp byte [eax + 0x6154], 0
jne 0x4063ac
mov edi, dword [esp + 0x130]
mov byte [esp + 0x15], 1
xor esi, esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], esi
cmp esi, edi
je 0x40656a
test byte [esp + 0x20], 0xf
jne 0x4063c4
call fcn.00480080
mov edx, dword [esp + 0x20]
push edx
lea ecx, [esp + 0xc8]
call fcn.00406b50
mov esi, eax
mov ecx, 0x14
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x80]
cmp eax, 2
je 0x4063f7
cmp eax, 3
jne 0x406554
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x619a], 0
mov esi, dword [esp + 0x54]
jne 0x40641b
mov ecx, dword [esp + 0x64]
push ecx
call fcn.0043c5c0
test al, al
jne 0x40641b
push esi
call fcn.0043cde0
mov edx, dword [ebp + 0x10]
cmp word [edx + 2], 0x46
setne al
cmp byte [esp + 0xa0], 0
je 0x4064c9
test al, al
je 0x406554
mov eax, dword [ebx + 0x38]
mov cl, byte [eax + 0x619a]
test cl, cl
je 0x406481
cmp byte [esp + 0x15], 0
je 0x406481
push esi
call fcn.0043ccc0
test al, al
je 0x406554
push esi
lea ecx, [esp + 0xb0]
call fcn.0043dac0
lea ecx, [esp + 0xac]
call fcn.0043cf30
mov byte [esp + 0x13], 1
jmp 0x406518
cmp byte [eax + 0x6199], 0
je 0x4064b1
push esi
call fcn.0043c940
test al, al
je 0x40649f
push esi
call fcn.0043cf90
jmp 0x406514
push 0x91
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x406518
test cl, cl
je 0x4064c1
lea ecx, [esp + 0xac]
call fcn.0043cf30
push esi
call fcn.0043c7e0
jmp 0x406514
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x619a], 0
push esi
je 0x4064ff
call fcn.0043ccc0
test al, al
je 0x406554
push esi
lea ecx, [esp + 0xb0]
call fcn.0043dac0
push esi
push 0
call fcn.004a00a0
call fcn.004a06c0
jmp 0x406554
cmp byte [eax + 0x6199], 0
je 0x40650f
call fcn.0043dbb0
jmp 0x406514
call fcn.0043c760
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x40652e
push esi
push 0
call fcn.004a00a0
call fcn.004a06c0
jmp 0x406554
push esi
push 0x202
call fcn.00475570
push eax
lea eax, [esp + 0x322a]
push eax
call fcn.004ad680
add esp, 0xc
mov ecx, 0x51ef08
call fcn.00433a70
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x40]
jne 0x4063b8
mov byte [esp + 0x2ec70], 3
lea ecx, [esp + 0xac]
call fcn.0043da60
cmp byte [esp + 0xe111], 0
je 0x4065a2
mov ebx, dword [ebx + 0x38]
cmp dword [ebx + 0x6140], 0
je 0x4065a2
lea ecx, [esp + 0xe156]
push ecx
push ebx
call fcn.0046b980
mov byte [esp + 0x2ec70], 2
lea ecx, [esp + 0x3204]
call fcn.0040c260
mov byte [esp + 0x2ec70], 1
lea ecx, [esp + 0xf15c]
call fcn.0040c260
mov byte [esp + 0x2ec70], 0x15
mov eax, dword [esp + 0x120]
test eax, eax
je 0x4065e6
push eax
call fcn.004c1aa4
add esp, 4
mov byte [esp + 0x2ec70], 0
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x406602
push eax
call fcn.004c1aa4
add esp, 4
mov dword [esp + 0x2ec70], 0xffffffff
lea ecx, [esp + 0x297b4]
call fcn.00478200
mov ecx, dword [esp + 0x2ec68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2ec50]
xor ecx, esp
call fcn.004c1302
mov esp, ebp
pop ebp
ret 0xc