Function at 0x4042e0
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d2c89
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2ec54
call fcn.004c1c40
mov eax, dword [0x4ec0b4]
xor eax, esp
mov dword [esp + 0x2ec50], eax
push ebx
push esi
push edi
mov eax, dword [0x4ec0b4]
xor eax, esp
push eax
lea eax, [esp + 0x2ec68]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor esi, esi
mov ebx, ecx
mov eax, dword [ebx + 0x38]
mov dword [esp + 0x34], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x38], esi
cmp word [eax + 0x73b0], si
je 0x404354
mov dword [eax + 0x6160], esi
mov dword [eax + 0x6164], esi
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x1010], si
je 0x4043c0
push 0x4d8824
push edi
call fcn.00460e70
test al, al
jne 0x4043c0
push 0x4d881c
push edi
call fcn.00460e70
test al, al
jne 0x4043c0
push 0x4d8814
push edi
call fcn.00460e70
test al, al
jne 0x4043ba
mov eax, edi
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x404392
mov ecx, dword [0x4d8808]
mov dword [eax], ecx
mov edx, dword [0x4d880c]
mov dword [eax + 4], edx
mov cx, word [0x4d8810]
mov word [eax + 8], cx
push edi
call fcn.00462210
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6198], 0
je 0x4043d2
push edi
call fcn.0043db30
xor eax, eax
mov word [esp + 0x2d7dc], ax
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x6160]
xor ecx, ecx
or edx, dword [eax + 0x6164]
mov word [esp + 0x2dc5c], cx
je 0x404400
mov byte [ebx + 0x18f8], 1
jmp 0x404407
and dword [eax + 0x6148], 0xffffffe7
mov eax, dword [ebx + 0x38]
movzx ecx, byte [eax + 0x6189]
mov edx, dword [eax + 0x615c]
push 1
push ecx
push edx
add eax, 0xc41c
push eax
lea ecx, [esp + 0x1b0c4]
mov byte [esp + 0x26], 0
call fcn.004786e0
xor edi, edi
mov dword [esp + 0x2ec70], edi
mov eax, dword [esp + 0x34]
push 0x800
push eax
lea ecx, [esp + 0x1e0e0]
push ecx
call fcn.0047fbe0
mov eax, dword [ebx + 0x38]
lea ecx, [esp + 0x31bc]
mov dword [esp + 0x1f0d8], eax
call fcn.00482f00
lea ecx, [esp + 0x31c4]
call fcn.00482f00
lea ecx, [esp + 0x31cc]
call fcn.00482f00
mov edx, dword [ebx + 0x38]
push edx
lea ecx, [esp + 0xc8]
call fcn.00406fb0
mov byte [esp + 0x2ec70], 1
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], di
lea esi, [eax + 0x73b0]
je 0x404512
push 0x50
lea eax, [esp + 0x58]
push edi
push eax
call fcn.004c2670
add esp, 0xc
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], esi
mov dword [esp + 0x80], 2
mov dword [esp + 0x9c], 0xffffffff
call fcn.00482f00
lea ecx, [esp + 0x44]
call fcn.00482e50
lea ecx, [esp + 0x44]
call fcn.00482e30
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0xc8]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
call fcn.00406b50
mov edi, 1
jmp 0x40468d
lea edx, [esp + 0x21ac]
push edx
lea ecx, [esp + 0x1b0b8]
call fcn.00478f80
test eax, eax
jne 0x40468d
or esi, 0xffffffff
mov eax, dword [esp + 0x130]
mov edx, dword [esp + 0x34]
push edi
push eax
lea ecx, [esp + 0x21b4]
push ecx
push edx
mov ecx, ebx
call fcn.00401580
test al, al
je 0x404671
push 0x50
lea eax, [esp + 0x58]
push 0
push eax
call fcn.004c2670
mov eax, dword [esp + 0x31bc]
mov edx, dword [esp + 0x31b8]
lea ecx, [esp + 0x21b8]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x31c0]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x31c4]
or byte [esp + 0x22], ah
mov dword [esp + 0x70], ecx
add esp, 0xc
lea ecx, [esp + 0x31bc]
mov dword [esp + 0x5c], edx
mov byte [esp + 0xa0], al
mov byte [esp + 0xa1], ah
call fcn.00482e30
lea ecx, [esp + 0x31cc]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
call fcn.00482e30
mov ecx, dword [ebx + 0x38]
mov dword [esp + 0x78], edx
movzx edx, word [esp + 0x1e0d4]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x21ac]
push eax
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], 2
mov dword [esp + 0xa0], esi
call fcn.00420fd0
test al, al
je 0x404611
or dword [esp + 0x94], 1
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xc48c], 0
jbe 0x404655
push 0x800
lea ecx, [esp + 0x1188]
push ecx
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.004016c0
mov eax, dword [esp + 0x31b8]
push 0
push 0
push eax
lea ecx, [esp + 0x1190]
push ecx
mov ecx, dword [ebx + 0x38]
call fcn.004218d0
test al, al
jne 0x404671
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0xc8]
call fcn.00406b50
cmp byte [esp + 0x31b8], 0
jne 0x404671
inc edi
lea eax, [esp + 0x21ac]
push eax
lea ecx, [esp + 0x1b0b8]
call fcn.00478f80
test eax, eax
je 0x404531
mov ecx, dword [esp + 0x130]
mov esi, dword [esp + 0x34]
push edi
push ecx
xor edi, edi
push edi
push edi
mov ecx, ebx
call fcn.00401580
cmp dword [esp + 0x1c0cc], edi
je 0x4046e7
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x62b2], 0
je 0x4046db
push 0x44c
call fcn.00475cc0
push eax
call fcn.004ad8e0
add esp, 4
push 6
mov ecx, 0x51ff10
call fcn.00433f40
jmp 0x4046e7
push 6
mov ecx, 0x51ff10
call fcn.00433d70
lea ecx, [esp + 0xc4]
call fcn.00407020
mov eax, dword [ebx + 0x38]
push eax
lea ecx, [esp + 0xf158]
call fcn.0040e460
mov byte [esp + 0x2ec70], 2
mov ecx, dword [ebx + 0x38]
push ecx
lea ecx, [esp + 0x31f8]
call fcn.0040e460
mov byte [esp + 0x2ec70], 3
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x5126], 0
je 0x40473f
cmp byte [eax + 0x5124], 0
je 0x40473f
mov ecx, 1
jmp 0x404741
xor ecx, ecx
mov byte [esp + 0xe110], cl
mov edx, dword [eax + 0x73ac]
mov ecx, dword [eax + 0x73a8]
push edx
mov edx, dword [eax + 0x73a4]
push ecx
push edx
lea ecx, [esp + 0x3200]
call fcn.0040bdc0
mov eax, dword [ebx + 0x38]
movzx ecx, byte [eax + 0x6195]
neg ecx
sbb ecx, ecx
and ecx, 3
inc ecx
push ecx
push esi
lea ecx, [esp + 0xf15c]
call fcn.0043ba80
test al, al
je 0x404aac
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x6160]
or edx, dword [eax + 0x6164]
jne 0x4047c6
cmp byte [esp + 0x1a068], dl
jne 0x4047b3
cmp dword [eax + 0x6148], edi
jne 0x4047c6
cmp byte [eax + 0x6197], 0
je 0x40481b
cmp dword [esp + 0x1a064], 2
jne 0x40481b
lea ecx, [esp + 0xf154]
call fcn.0043c3b0
cmp eax, 0x14
jne 0x4047f7
cmp edx, edi
jne 0x4047f7
lea ecx, [esp + 0xf154]
call fcn.0043bda0
mov dword [esp + 0x10174], 1
jmp 0x404aba
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x6160]
or ecx, dword [eax + 0x6164]
je 0x40481b
mov dword [eax + 0x6160], edi
mov dword [eax + 0x6164], edi
mov byte [ebx + 0x18f8], 0
push edi
lea ecx, [esp + 0xf158]
call fcn.0040e6d0
lea ecx, [esp + 0xf154]
call fcn.0040bcb0
test al, al
jne 0x404843
push esi
mov ecx, 0x51ff10
call fcn.004344c0
lea ecx, [esp + 0xf154]
call fcn.0040ba60
push edi
lea ecx, [esp + 0xf158]
call fcn.0040bb10
test al, al
je 0x40486c
push 4
mov ecx, 0x51ff10
call fcn.00433f40
lea ecx, [esp + 0xf154]
call fcn.0040bbd0
test al, al
je 0x404888
push 3
mov ecx, 0x51ff10
call fcn.00433f40
mov dl, byte [esp + 0x1a068]
mov byte [esp + 0xe108], dl
push 1
push esi
push edi
call fcn.0040a580
cmp dword [esp + 0xf158], 0xffffffff
mov eax, dword [esp + 0x130]
setne byte [esp + 0x17]
xor esi, esi
mov byte [esp + 0x14], 0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
cmp eax, esi
jbe 0x404991
lea edi, [esi + 3]
lea ecx, [ecx]
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
cmp dword [eax + 0x2c], 2
je 0x4048f9
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
cmp dword [eax + 0x2c], edi
jne 0x404981
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
mov ecx, dword [eax + 0xc]
cmp ecx, dword [esp + 0x30]
jb 0x404935
ja 0x40491a
mov edx, dword [eax + 8]
cmp edx, dword [esp + 0x2c]
jbe 0x404935
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], edx
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
mov ecx, dword [eax + 8]
add dword [esp + 0xe13c], ecx
mov edx, dword [eax + 0xc]
push esi
adc dword [esp + 0xe144], edx
lea ecx, [esp + 0xc8]
call fcn.00406ba0
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x31f8]
call fcn.0040baf0
add dword [esp + 0xe144], eax
adc dword [esp + 0xe148], 0
mov eax, dword [esp + 0x130]
inc esi
cmp esi, eax
jb 0x4048d0
cmp byte [esp + 0x17], 0
je 0x404b7d
mov ecx, dword [esp + 0x1a064]
mov dword [esp + 0xe104], ecx
test eax, eax
jne 0x4049bd
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x62b2], al
je 0x404bd1
lea ecx, [esp + 0x31f4]
call fcn.0040bc10
push 0
push 1
lea eax, [esp + 0xf15c]
push eax
lea ecx, [esp + 0x3200]
call fcn.00410490
lea ecx, [esp + 0xe11a]
push ecx
lea edx, [esp + 0x19]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0xd0]
push ecx
lea edx, [esp + 0xf164]
push edx
mov ecx, ebx
call fcn.00402690
cmp byte [esp + 0x15], 0
je 0x404bd1
xor esi, esi
cmp dword [esp + 0x130], esi
jbe 0x404a43
lea edi, [esi + 4]
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
cmp dword [eax + 0x2c], edi
jne 0x404bd1
inc esi
cmp esi, dword [esp + 0x130]
jb 0x404a23
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6180], 0
jne 0x404bd1
push 0xa
mov ecx, 0x51ff10
call fcn.00433d70
lea ecx, [esp + 0x31f4]
call fcn.0043bda0
mov byte [esp + 0x2ec70], 2
lea ecx, [esp + 0x31f4]
call fcn.0040c270
mov byte [esp + 0x2ec70], 1
lea ecx, [esp + 0xf154]
call fcn.0040c270
mov byte [esp + 0x2ec70], 0
lea ecx, [esp + 0xc4]
call fcn.00402620
jmp 0x406652
cmp dword [esp + 0x10174], 1
jne 0x404b60
push 1
push esi
lea ecx, [esp + 0x31fc]
mov byte [esp + 0xe154], 1
call fcn.0043c1b0
mov edx, dword [ebx + 0x38]
cmp word [edx + 0x1010], di
je 0x404b3f
lea ecx, [esp + 0x1184]
call fcn.0043ba40
mov byte [esp + 0x2ec70], 4
mov eax, dword [ebx + 0x38]
add eax, 0x1010
push eax
lea ecx, [esp + 0x1188]
call fcn.0043c170
push 0x7fffffff
push 0x7fffffff
lea ecx, [esp + 0x31fc]
push ecx
lea ecx, [esp + 0x1190]
call fcn.0043c670
mov dword [esp + 0xe114], eax
mov byte [esp + 0x2ec70], 3
lea ecx, [esp + 0x1184]
call fcn.0043c140
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6148], edi
je 0x404b5a
cmp dword [eax + 0x6134], edi
je 0x404b5a
mov byte [esp + 0xe108], 1
push edi
jmp 0x404898
push esi
push edi
mov ecx, 0x51ff10
call fcn.00434330
push 9
mov ecx, 0x51ff10
call fcn.00433f40
jmp 0x40489f
mov ecx, dword [ebx + 0x38]
xor edx, edx
cmp byte [ecx + 0x6197], dl
push 0
setne dl
push 0
lea eax, [esp + 0xf15c]
push eax
lea ecx, [esp + 0x3200]
add edx, 2
mov dword [esp + 0xe110], edx
call fcn.00410490
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x6160]
mov eax, dword [eax + 0x6164]
mov edx, ecx
or edx, eax
je 0x404bd1
push eax
push ecx
lea eax, [esp + 0x31fc]
push eax
call fcn.004930b0
mov ecx, dword [esp + 0xe104]
push ecx
mov ecx, dword [ebx + 0x38]
call fcn.00421210
xor esi, esi
cmp dword [esp + 0x130], esi
jbe 0x404c3f
lea edi, [esi + 2]
nop
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6153], 0
je 0x404c0e
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
cmp dword [eax + 0x2c], edi
je 0x404c21
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
cmp dword [eax + 0x2c], 1
jne 0x404c35
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
mov dword [eax + 0x2c], 0
inc esi
cmp esi, dword [esp + 0x130]
jb 0x404bf0
mov esi, dword [ebx + 0x38]
cmp word [esi + 0x73b0], 0
jne 0x404ce3
cmp byte [esp + 0x17], 0
je 0x404c65
cmp byte [esp + 0x1a068], 0
jne 0x404ce3
cmp byte [esp + 0x16], 0
jne 0x404ce3
mov eax, dword [esi + 0x6148]
test eax, eax
je 0x404c8a
mov ecx, dword [esp + 0xe13c]
mov edx, dword [esp + 0xe140]
jmp 0x404c92
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
neg eax
sbb eax, eax
and eax, 0xe0000
add eax, 0x20000
cmp dword [esi + 0xc], eax
jbe 0x404ce3
push 0
push 2
push edx
push ecx
call fcn.004c2390
mov edi, eax
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0xc]
xor esi, esi
cmp esi, edx
jb 0x404ce3
ja 0x404cc4
cmp eax, edi
jbe 0x404ce3
shr dword [ecx + 0xc], 1
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0x6148]
neg eax
sbb eax, eax
and eax, 0xe0000
add eax, 0x20000
cmp dword [ecx + 0xc], eax
ja 0x404cb2
mov esi, 3
mov ecx, 0x400000
cmp dword [esp + 0xe104], esi
jne 0x404d09
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x619c], 0
je 0x404d1e
mov byte [eax + 0x619c], 0
cmp dword [esp + 0xe104], 2
jne 0x404d1e
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xc], ecx
jbe 0x404d1e
mov dword [eax + 0xc], ecx
mov eax, dword [ebx + 0x38]
xor edi, edi
cmp dword [eax + 0x6134], edi
jne 0x404d38
mov ecx, 0x20000
cmp dword [eax + 0xc], ecx
jbe 0x404d38
mov dword [eax + 0xc], ecx
cmp byte [esp + 0xe108], 0
je 0x404d52
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x617d], 0
jne 0x404d52
mov al, 1
jmp 0x404d54
xor al, al
push edi
push eax
lea ecx, [esp + 0xcc]
call fcn.004072c0
mov edx, dword [ebx + 0x38]
cmp dword [edx + 0x61a0], edi
je 0x404d9a
cmp dword [esp + 0xe104], esi
jne 0x404d9a
push 0x62c
call fcn.00475cc0
push eax
call fcn.004a08a0
call fcn.004a0fb0
lea eax, [esp + 0xc4]
push eax
mov ecx, ebx
call fcn.00402c10
mov ecx, dword [ebx + 0x3c]
cmp ecx, edi
je 0x404da9
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp byte [esp + 0x17], 0
je 0x404de3
cmp dword [esp + 0x1a064], esi
je 0x404def
push 0x1b498
call fcn.004c2bd0
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x2ec70], 6
cmp eax, edi
je 0x404e19
lea ecx, [ebx + 0x58]
push ecx
mov ecx, eax
call fcn.0045cd90
jmp 0x404e1b
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x6197], 0
je 0x404db9
push 0x6228
call fcn.004c2bd0
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x2ec70], 5
cmp eax, edi
je 0x404e19
lea edx, [ebx + 0x58]
push edx
mov ecx, eax
call fcn.00456410
jmp 0x404e1b
xor eax, eax
mov byte [esp + 0x2ec70], 3
mov edx, dword [ebx + 0x38]
mov dword [ebx + 0x3c], eax
mov dword [edx + 0xa3c8], eax
lea eax, [ebx + 0x58]
push eax
lea ecx, [esp + 0x1f0e0]
call fcn.00490b80
mov byte [esp + 0x2ec70], 7
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax + 0x83b0]
mov edx, dword [edx + 0x20]
push eax
call edx
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x83b0]
cmp ecx, 8
jb 0x404e6e
mov ecx, 8
mov dword [esp + 0x1f0f8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov esi, eax
push eax
mov eax, dword [edx + 4]
call eax
test al, al
jne 0x404eb6
mov edi, 0x100000
mov edi, edi
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xc], edi
jbe 0x404f56
shr dword [eax + 0xc], 1
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
mov edx, dword [ecx]
mov eax, dword [eax + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
test al, al
je 0x404e90
xor edi, edi
mov ecx, dword [ebx + 0x38]
mov eax, dword [ecx + 0xc]
cmp esi, eax
je 0x404edb
shr eax, 0x14
push eax
shr esi, 0x14
push esi
push 0x663
call fcn.00475cc0
push eax
call fcn.004ad8e0
add esp, 0xc
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
lea esi, [ebx + 8]
push esi
call eax
cmp byte [esp + 0x1a068], 0
lea eax, [ebx + 0x58]
mov dword [esi + 0x24], ebx
mov ecx, dword [ebx + 0x38]
mov dword [esi + 0x2c], eax
lea edx, [esp + 0xf154]
lea eax, [esp + 0x31f4]
mov dword [esi + 0x28], ecx
mov dword [esi + 0x20], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0x18], edx
mov dword [esi + 0x1c], eax
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
je 0x404fad
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x5124], 0
jne 0x404f40
cmp byte [esp + 0x14], 0
je 0x404f8d
mov edx, dword [ebx + 0x48]
add dword [esp + 0xe13c], edx
mov eax, dword [ebx + 0x4c]
adc dword [esp + 0xe140], eax
jmp 0x404f92
push 1
push section..data
lea ecx, [esp + 0x4c]
call fcn.004c1cbe
mov byte [esp + 0x2ec70], 8
mov dword [esp + 0x44], vtable.std::bad_alloc.0
mov byte [esp + 0x2ec70], 7
push 0x4e2f70
lea eax, [esp + 0x48]
push eax
call fcn.004c2b33
mov byte [esp + 0x15], 1
push edi
lea ecx, [esp + 0xf158]
call fcn.00410a30
push edx
push eax
lea ecx, [esp + 0xf160]
call fcn.0040be30
xor esi, esi
mov dword [esp + 0xa8], esi
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], edi
mov dword [esp + 0xb4], edi
mov byte [esp + 0x2ec70], 9
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x130], edi
jbe 0x405de8
lea esp, [esp]
mov ecx, dword [esp + 0x1c]
push ecx
lea ecx, [esp + 0xc8]
call fcn.00406ba0
mov ecx, 0x14
mov esi, eax
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
cmp dword [esp + 0x80], 0
je 0x405dcb
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x90]
jmp 0x405030
mov eax, dword [esp + 0x80]
cmp eax, 6
je 0x40594e
cmp eax, 5
je 0x405a50
cmp eax, 4
je 0x405a5e
push 0
lea ecx, [esp + 0x96a0]
call fcn.00442c40
lea ecx, [esp + 0x114c]
call fcn.00482f00
lea ecx, [esp + 0x1154]
call fcn.00482f00
lea ecx, [esp + 0x115c]
call fcn.00482f00
lea ecx, [esp + 0x1184]
call fcn.0043ba40
mov byte [esp + 0x2ec70], 0xa
cmp byte [esp + 0xa1], 0
je 0x4050d9
cmp dword [esp + 0xe104], 3
jne 0x4050d9
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6189], 0
mov byte [esp + 0x13], 1
je 0x4050de
mov ecx, dword [esp + 0x54]
lea eax, [esp + 0x969c]
push eax
push ecx
call fcn.00437150
cmp dword [esp + 0xa78c], 0
jne 0x4050de
mov byte [esp + 0x13], 0
mov al, byte [esp + 0xa0]
test al, al
jne 0x405101
cmp byte [esp + 0x13], al
je 0x4050fa
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6189], al
jne 0x405101
mov byte [esp + 0x28], 0
jmp 0x40511a
mov byte [esp + 0x28], 1
test al, al
je 0x40511a
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6158], 1
je 0x405db7
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], 0
jne 0x405167
movzx ecx, byte [eax + 0x6189]
mov eax, dword [esp + 0x54]
push ecx
lea edx, [esp + 0x140]
push edx
push eax
call fcn.00441e10
cmp byte [esp + 0xa0], 0
mov byte [esp + 0x13], al
je 0x405177
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push ecx
push edx
lea ecx, [esp + 0x1164]
call fcn.00482e40
jmp 0x405177
mov byte [esp + 0x13], 0
mov dword [esp + 0x1190], 1
mov cl, byte [esp + 0x28]
test cl, cl
jne 0x405302
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], 0
jne 0x405302
cmp byte [esp + 0x13], cl
je 0x4051ba
movzx eax, byte [eax + 0x6195]
mov ecx, dword [esp + 0x54]
neg eax
sbb eax, eax
and eax, 4
push eax
push ecx
lea ecx, [esp + 0x118c]
call fcn.0043ba80
cmp dword [esp + 0x1188], 0xffffffff
jne 0x40525b
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x34]
push edx
push eax
mov ecx, 0x51ff10
call fcn.00434300
mov ecx, dword [esp + 0x5c]
sub dword [esp + 0xe13c], ecx
mov edx, dword [esp + 0x60]
push edi
sbb dword [esp + 0xe144], edx
lea ecx, [esp + 0xc8]
call fcn.00406ba0
inc dword [esp + 0x20]
mov dword [eax + 0x2c], 0
test esi, esi
jl 0x405db7
jg 0x405222
cmp dword [esp + 0x8c], 0
jbe 0x405db7
cmp dword [esp + 0x98], 0
jne 0x405db7
mov dword [esp + 0x80], 4
mov dword [ebx + 0x40], 0
mov byte [esp + 0x2ec70], 9
lea ecx, [esp + 0x1184]
call fcn.0043c140
jmp 0x405030
cmp byte [esp + 0x13], 0
je 0x405276
lea ecx, [esp + 0x114c]
call fcn.00482e30
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
cmp byte [esp + 0xa1], 0
jne 0x405324
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x618a], 0
je 0x405324
cmp dword [esp + 0xe104], 3
jne 0x405324
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0xac]
push edx
lea eax, [esp + 0x118c]
push eax
mov ecx, ebx
mov dword [esp + 0xc8], edi
call fcn.004029d0
test al, al
je 0x405324
mov edx, dword [esp + 0xbc]
push 0x800
lea ecx, [esp + 0xa794]
push ecx
push edx
lea ecx, [esp + 0xd0]
mov dword [esp + 0xa798], 4
call fcn.00406ba0
push eax
mov eax, dword [ebx + 0x38]
push eax
jmp 0x40538f
cmp byte [esp + 0xa1], 0
jne 0x40531c
xor eax, eax
mov dword [esp + 0x113c], eax
mov dword [esp + 0x1140], eax
test cl, cl
jne 0x405399
cmp dword [esp + 0x9c], 0xffffffff
je 0x405399
cmp dword [esp + 0x1188], 0xffffffff
je 0x405344
lea ecx, [esp + 0x1184]
call fcn.0043bd40
mov esi, dword [esp + 0x9c]
push esi
lea ecx, [esp + 0xc8]
call fcn.00406ba0
mov eax, dword [eax + 0x2c]
cmp eax, 2
je 0x405365
cmp eax, 3
jne 0x405399
push 0x800
lea ecx, [esp + 0xa794]
push ecx
push esi
lea ecx, [esp + 0xd0]
mov dword [esp + 0xa798], 5
call fcn.00406ba0
mov edx, dword [ebx + 0x38]
push eax
push edx
call fcn.004016c0
mov byte [esp + 0x28], 1
mov eax, dword [esp + 0x54]
push eax
push 1
mov ecx, 0x51ff20
call fcn.00421480
mov eax, dword [ebx + 0x38]
push 0x800
lea ecx, [esp + 0x96c0]
push ecx
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.004016c0
cmp byte [esp + 0x16], 0
je 0x405434
lea ecx, [esp + 0xf154]
call fcn.0040be70
push 0
lea ecx, [esp + 0xf158]
mov esi, eax
mov edi, edx
call fcn.00410a30
push edx
push eax
lea ecx, [esp + 0xf160]
call fcn.0040be30
push 0
lea ecx, [esp + 0x1f0e0]
push ecx
push edi
push esi
lea edx, [esp + 0xf164]
push edx
mov ecx, ebx
call fcn.004023e0
mov edx, dword [ebx + 0x38]
mov edx, dword [edx + 0x6134]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
dec edx
push edx
lea edx, [esp + 0x1f0e0]
push edx
call eax
mov byte [ebx + 0x54], 1
xor edi, edi
cmp byte [esp + 0xe108], 0
mov byte [esp + 0x16], 0
mov byte [esp + 0x15], 0
je 0x405563
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0x6148]
mov byte [esp + 0x14], 0
test cl, 2
je 0x405481
mov esi, dword [eax + 0x614c]
cmp esi, edi
jle 0x405481
cmp dword [esp + 0x18], edi
jle 0x405481
mov eax, dword [esp + 0x18]
cdq
idiv esi
test edx, edx
jne 0x405481
mov byte [esp + 0x14], 1
test cl, 4
je 0x4054cc
lea ecx, [esp + 0x96bc]
push ecx
call fcn.00460e50
mov esi, eax
cmp esi, edi
je 0x4054c2
lea edx, [esp + 0x2d7dc]
push edx
push esi
call fcn.0047fb90
test eax, eax
je 0x4054b0
mov byte [esp + 0x14], 1
push 0x40
push esi
lea eax, [esp + 0x2d7e4]
push eax
call fcn.0047fbe0
jmp 0x4054cc
xor ecx, ecx
mov word [esp + 0x2d7dc], cx
mov edx, dword [ebx + 0x38]
mov edx, dword [edx + 0x6148]
test dl, 8
jne 0x40552e
lea ecx, [esp + 0x3212]
lea eax, [esp + 0x2dc5c]
mov si, word [eax]
cmp si, word [ecx]
jne 0x40550e
cmp si, di
je 0x40550a
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x40550e
add eax, 4
add ecx, 4
cmp si, di
jne 0x4054e8
xor eax, eax
jmp 0x405513
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x40552e
test dl, 0x10
jne 0x405535
cmp dword [esp + 0x30], edi
jg 0x405535
jl 0x40552e
cmp dword [esp + 0x2c], 0x400000
ja 0x405535
cmp byte [esp + 0x14], 0
je 0x405553
cmp dword [esp + 0x18], edi
jle 0x405553
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
mov byte [ebx + 0x54], 0
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
jmp 0x405563
mov eax, dword [esp + 0x5c]
add dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x60]
adc dword [esp + 0x30], ecx
xor eax, eax
jmp 0x405570
movzx ecx, word [esp + eax + 0x3212]
mov word [esp + eax + 0x2dc5c], cx
add eax, 2
cmp cx, di
jne 0x405570
mov eax, dword [esp + 0x80]
cmp eax, 2
jne 0x40559e
mov edx, dword [esp + 0x54]
push edi
push edi
push edi
push edx
jmp 0x4055ac
cmp eax, 3
jne 0x4055b2
mov eax, dword [esp + 0x54]
push edi
push edi
push 1
push eax
push edi
call fcn.0040a5c0
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], di
jne 0x4055ce
mov ecx, dword [esp + 0x114c]
or ecx, dword [esp + 0x1150]
jne 0x4055e0
mov dword [esp + 0x113c], edi
mov dword [esp + 0x1140], 0x100
cmp dword [esp + 0xe104], 3
mov edx, dword [esp + 0x113c]
mov ecx, dword [esp + 0x1140]
mov dword [esp + 0x96a0], 2
mov dword [esp + 0xa6ec], edx
mov dword [esp + 0xa6f0], ecx
mov dword [esp + 0xa6e4], edi
mov dword [esp + 0xa6e8], edi
jne 0x405627
mov edi, dword [eax + 0x6138]
jmp 0x40562c
mov edi, 2
push edi
lea ecx, [esp + 0xa700]
call fcn.00442790
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x5124], 0
je 0x4056e9
cmp byte [esp + 0xa0], 0
jne 0x4056e9
mov esi, dword [esp + 0xe104]
cmp esi, 3
jne 0x40569f
push 0x10
lea eax, [esp + 0xa741]
push eax
call fcn.0042a430
mov esi, dword [esp + 0xe104]
xor ecx, ecx
cmp byte [esp + 0xe110], cl
mov dword [esp + 0xa778], 0xf
sete cl
mov byte [esp + 0xa74d], 1
mov byte [esp + 0xa756], cl
mov edx, dword [esp + 0xe11a]
mov eax, dword [esp + 0xe11e]
mov ecx, dword [esp + 0xe122]
mov dword [esp + 0xa72d], edx
mov edx, dword [esp + 0xe126]
mov byte [esp + 0xa727], 1
mov byte [esp + 0xa72c], 1
mov dword [esp + 0xa731], eax
mov dword [esp + 0xa735], ecx
mov dword [esp + 0xa739], edx
jmp 0x4056f0
mov esi, dword [esp + 0xe104]
mov eax, esi
sub eax, 3
neg eax
sbb eax, eax
and eax, 0x1d
cmp byte [ebx + 0x54], 0
mov byte [esp + 0x96b5], al
mov eax, dword [ebx + 0x38]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0xa780], ecx
mov byte [esp + 0xa77d], 0
je 0x405726
mov byte [esp + 0xa77c], 1
cmp byte [esp + 0x13], 0
je 0x405785
mov edx, dword [esp + 0x114c]
mov ecx, dword [esp + 0x1150]
mov dword [esp + 0xa6cc], edx
mov edx, dword [esp + 0x115c]
mov dword [esp + 0xa6d0], ecx
mov ecx, dword [esp + 0x1160]
mov dword [esp + 0xa6dc], edx
mov edx, dword [esp + 0x1154]
mov dword [esp + 0xa6e0], ecx
mov ecx, dword [esp + 0x1158]
mov dword [esp + 0xa6d4], edx
mov dword [esp + 0xa6d8], ecx
xor edx, edx
jmp 0x4057b1
xor edx, edx
mov dword [esp + 0xa6cc], edx
mov dword [esp + 0xa6d0], edx
mov dword [esp + 0xa6dc], edx
mov dword [esp + 0xa6e0], edx
mov dword [esp + 0xa6d4], edx
mov dword [esp + 0xa6d8], edx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x96b8], ecx
cmp esi, 2
je 0x4057ca
cmp dword [esp + 0xa78c], edx
jne 0x4057d7
and ecx, 0xfffffbff
mov dword [esp + 0x96b8], ecx
cmp dword [esp + 0xa6f0], edx
movzx ecx, byte [esp + 0xa0]
mov byte [esp + 0xa77d], cl
movzx ecx, byte [eax + 0x6134]
mov byte [esp + 0x96b6], cl
jg 0x40581a
jl 0x40580c
cmp dword [esp + 0xa6ec], 0x80000000
ja 0x40581a
cmp word [eax + 0x73b0], dx
jne 0x40581a
cmp esi, 3
jne 0x405822
mov byte [esp + 0xa785], 1
mov edx, dword [eax + 0x83b0]
push edx
push edi
lea ecx, [ebx + 0x24ac]
call fcn.004428c0
lea eax, [esp + 0x31f4]
push eax
lea ecx, [esp + 0x1188]
push ecx
lea esi, [ebx + 0x58]
mov ecx, esi
mov dword [esp + 0xa790], 0
call fcn.00468330
xor eax, eax
mov dword [ebx + 0x1908], eax
mov dword [ebx + 0x190c], eax
mov eax, dword [esp + 0x113c]
mov dword [esp + 0xa6f4], eax
mov edx, dword [esp + 0x1140]
xor edi, edi
cmp byte [esp + 0x28], 0
mov byte [ebx + 0xa8], 1
mov dword [esp + 0xa6f8], edx
jne 0x405c7a
mov ecx, dword [ebx + 0x38]
cmp word [ecx + 0x73b0], di
jne 0x405c7a
lea edx, [esp + 0x3e]
push edx
lea eax, [esp + 0x43]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00468250
cmp byte [esp + 0x3f], 0
je 0x405b8e
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x34]
push edx
push eax
mov ecx, 0x51ff10
call fcn.00434300
mov ecx, dword [esp + 0x5c]
sub dword [esp + 0xe13c], ecx
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x60]
sbb dword [esp + 0xe140], edx
push eax
lea ecx, [esp + 0xc8]
call fcn.00406ba0
inc dword [esp + 0x20]
cmp dword [esp + 0x90], edi
mov dword [eax + 0x2c], edi
jl 0x405db7
jg 0x405927
cmp dword [esp + 0x8c], edi
jbe 0x405db7
mov dword [esp + 0x80], 4
mov dword [ebx + 0x40], edi
mov byte [esp + 0x2ec70], 9
lea ecx, [esp + 0x1184]
call fcn.0043c140
jmp 0x40501c
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x8c]
push 0
push esi
push ecx
lea ecx, [esp + 0xf160]
call fcn.0040be30
lea ecx, [esp + 0xf154]
call fcn.00413370
mov eax, dword [esp + 0x148c8]
cmp eax, 2
je 0x4059f5
cmp eax, 3
je 0x4059fe
mov dl, byte [esp + 0x1a070]
cmp dl, byte [esp + 0xe110]
jne 0x405dcb
mov eax, dword [esp + 0x1a058]
mov ecx, dword [esp + 0x1a054]
push 0
push eax
push ecx
lea ecx, [esp + 0xf160]
call fcn.0040be30
mov edx, dword [esp + 0x1a05c]
sub edx, dword [esp + 0x1a054]
mov eax, dword [esp + 0x1a060]
sbb eax, dword [esp + 0x1a058]
lea ecx, [esp + 0x31f4]
push eax
push edx
push ecx
lea ecx, [esp + 0xf160]
call fcn.0043c670
jmp 0x405dcb
lea ecx, [esp + 0x155fc]
jmp 0x405a05
lea ecx, [esp + 0x1793c]
push 0
push 0
push ecx
push eax
lea ecx, [esp + 0x3204]
call fcn.0040e7c0
lea ecx, [esp + 0xf154]
call fcn.0040be70
mov ecx, dword [esp + 0x1a05c]
sub ecx, eax
mov eax, dword [esp + 0x1a060]
sbb eax, edx
push eax
push ecx
lea ecx, [esp + 0x31fc]
push ecx
lea ecx, [esp + 0xf160]
call fcn.0043c670
jmp 0x405dcb
inc dword [esp + 0x38]
call fcn.004807d0
jmp 0x405dcb
cmp byte [esp + 0x1a068], 0
je 0x405ac8
cmp byte [esp + 0x15], 0
jne 0x405ac8
mov eax, dword [esp + 0x8c]
push 0
lea edx, [esp + 0x1f0e0]
push edx
push esi
push eax
lea ecx, [esp + 0xf164]
push ecx
mov ecx, ebx
call fcn.004023e0
mov edx, dword [esp + 0x98]
mov ecx, dword [ebx + 0x3c]
push edx
push 0
lea eax, [esp + 0x1f0e4]
push eax
push ecx
lea edx, [esp + 0x3204]
push edx
lea eax, [esp + 0xf168]
push eax
mov ecx, ebx
call fcn.004038a0
call fcn.004807d0
jmp 0x405dcb
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x8c]
push 0
push esi
push ecx
lea ecx, [esp + 0xf160]
call fcn.0040be30
lea ecx, [esp + 0xf154]
call fcn.00413370
lea edx, [esp + 0x155fc]
push edx
lea ecx, [esp + 0x96a0]
call fcn.00442d20
mov eax, dword [esp + 0x98]
test eax, eax
je 0x405b24
push eax
lea eax, [esp + 0x96a0]
push eax
mov ecx, ebx
call fcn.004017d0
lea ecx, [esp + 0xf154]
call fcn.00410950
test al, al
jne 0x405b3f
mov cl, byte [esp + 0x1a068]
mov byte [esp + 0x16], cl
cmp byte [esp + 0x16], 0
je 0x405b5c
mov edx, dword [ebx + 0x38]
mov eax, dword [edx + 0xc]
cmp eax, dword [esp + 0xa780]
jbe 0x405b5c
mov dword [esp + 0xa780], eax
push 0
push 0
push 0
push 2
lea ecx, [esp + 0x3204]
call fcn.0040e7c0
lea eax, [esp + 0xf154]
push eax
lea ecx, [esp + 0x31f8]
call fcn.0040bc60
call fcn.004807d0
jmp 0x405dcb
cmp byte [esp + 0x3e], 0
je 0x405be3
mov ecx, dword [esp + 0x1140]
mov edx, dword [esp + 0x24]
xor eax, eax
cmp ecx, eax
mov eax, dword [esp + 0x113c]
ja 0x405bcb
jb 0x405bb3
cmp eax, edx
jae 0x405bcb
mov byte [esp + 0x40], 1
mov edx, dword [esp + 0x40]
push edx
push 1
push ecx
push eax
call fcn.00401870
jmp 0x405c6c
mov byte [esp + 0x40], 0
mov edx, dword [esp + 0x40]
push edx
push 1
push ecx
push eax
call fcn.00401870
jmp 0x405c6c
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov esi, ecx
push esi
mov dword [esp + 0x1140], eax
mov edi, eax
add eax, 0x200
mov dword [esp + 0x1144], ecx
push 2
adc ecx, ecx
push ecx
push eax
call fcn.004c2390
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edx
cmp edx, esi
ja 0x405c2a
jb 0x405c1e
cmp eax, edi
jae 0x405c2a
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x40000000
mov edi, dword [esp + 0x44]
mov esi, 1
xor eax, eax
mov edx, esi
add edx, 0xffffffff
mov ecx, eax
adc ecx, 0xffffffff
cmp dword [esp + 0x48], ecx
jb 0x405c5e
ja 0x405c4b
cmp edi, edx
jb 0x405c5e
shld eax, esi, 7
shl esi, 7
mov edx, esi
or edx, eax
jne 0x405c35
mov edx, dword [esp + 0x48]
jmp 0x405c68
add esi, 0xffffffff
adc eax, 0xffffffff
mov edi, esi
mov edx, eax
mov eax, edi
xor edi, edi
mov dword [esp + 0xa6f4], eax
mov dword [esp + 0xa6f8], edx
mov ecx, dword [esp + 0xe104]
inc dword [esp + 0x18]
cmp ecx, 3
jne 0x405c96
mov dword [ebx + 0x1930], eax
mov dword [ebx + 0x1934], edx
test byte [esp + 0x94], 1
jne 0x405caf
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6134], edi
je 0x405caf
xor al, al
jmp 0x405cb1
mov al, 1
cmp byte [esp + 0x28], 0
mov byte [esp + 0x14], al
jne 0x405cc0
test al, al
je 0x405ce5
mov edx, dword [ebx + 0x38]
mov byte [esp + 0x96b6], 0
cmp byte [edx + 0x5124], 0
jne 0x405ce1
cmp ecx, 3
je 0x405ce1
mov byte [esp + 0x96b5], 0x14
test al, al
jne 0x405d11
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
xor ecx, ecx
add eax, dword [esp + 0xa6ec]
adc ecx, dword [esp + 0xa6f0]
mov dword [esp + 0xc0], ecx
js 0x405d1b
jg 0x405d11
cmp eax, 0x8000
jbe 0x405d1b
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x54]
mov eax, dword [ebx + 0x3c]
push ecx
push 1
push edx
push eax
lea ecx, [esp + 0x1194]
push ecx
lea esi, [ebx + 8]
mov ecx, esi
call fcn.00403680
cmp byte [esp + 0x28], 0
jne 0x405d9b
cmp byte [esp + 0x14], 0
je 0x405d6c
push edi
mov ecx, esi
call fcn.00403740
lea eax, [ebx + 0x58]
push eax
call fcn.00402920
push edi
mov ecx, esi
call fcn.00403150
mov dword [esi + 8], edi
mov dword [esi + 4], edi
jmp 0x405d9b
mov eax, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
lea esi, [eax + 0x62dc]
mov eax, dword [eax + 0x6134]
push esi
dec eax
push eax
movzx eax, byte [ebx + 0x54]
push eax
call edx
cmp byte [esp + 0xe108], 0
je 0x405da5
mov byte [ebx + 0x54], 1
cmp byte [esp + 0xe108], 0
jne 0x405daf
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
call fcn.004807d0
mov dword [ebx + 0x28], edi
mov byte [esp + 0x2ec70], 9
lea ecx, [esp + 0x1184]
call fcn.0043c140
mov eax, dword [esp + 0x1c]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x130]
jb 0x404ff0
mov esi, dword [esp + 0xa8]
mov ecx, dword [ebx + 0x3c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
call edx
cmp dword [esp + 0x20], 0
mov eax, dword [ebx + 0x38]
mov dword [eax + 0xa3c8], 0
jle 0x405e12
push 6
mov ecx, 0x51ff10
call fcn.00433d70
cmp dword [esp + 0x18], 0
jne 0x405eb2
cmp dword [esp + 0x38], 0
jne 0x405eb2
push 0xa
mov ecx, 0x51ff10
call fcn.00433d70
lea ecx, [esp + 0x31f4]
call fcn.0043bda0
mov byte [esp + 0x2ec70], 7
test esi, esi
je 0x405e55
push esi
call fcn.004c23c4
add esp, 4
mov byte [esp + 0x2ec70], 3
lea ecx, [esp + 0x1f0dc]
call fcn.0048de20
mov byte [esp + 0x2ec70], 2
lea ecx, [esp + 0x31f4]
call fcn.0040c270
mov byte [esp + 0x2ec70], 1
lea ecx, [esp + 0xf154]
call fcn.0040c270
mov byte [esp + 0x2ec70], 0xb
mov eax, dword [esp + 0x120]
test eax, eax
je 0x405ead
push eax
call fcn.004c23c4
add esp, 4
jmp 0x406636
cmp byte [esp + 0x17], 0
je 0x405ecf
lea ecx, [esp + 0xf154]
push ecx
lea ecx, [esp + 0x31f8]
call fcn.0040f390
jmp 0x405edf
push 0
push 0
lea ecx, [esp + 0x31fc]
call fcn.0040f9c0
mov byte [esp + 0x2ec70], 7
test esi, esi
je 0x405ef4
push esi
call fcn.004c23c4
add esp, 4
mov byte [esp + 0x2ec70], 3
lea ecx, [esp + 0x1f0dc]
call fcn.0048de20
lea edx, [esp + 0x3212]
push edx
push 0
mov ecx, 0x51ff20
call fcn.00421480
mov eax, dword [ebx + 0x38]
movzx esi, word [eax + 0x639c]
add eax, 0x639c
test si, si
je 0x405f5a
xor ecx, ecx
cmp si, 0x40
sete cl
lea edx, [esp + 0x3212]
dec ecx
and eax, ecx
push eax
push edx
call fcn.00480a30
test al, al
jne 0x405f5a
push 2
mov ecx, 0x51ff10
call fcn.00433f40
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x6150], 0
je 0x40609d
push 0x33e
call fcn.00475cc0
push eax
call fcn.004a08a0
call fcn.004a0fb0
cmp dword [esp + 0x130], 0
mov dword [esp + 0x38], 0
jbe 0x40609d
jmp 0x405fa0
mov ecx, dword [esp + 0x38]
push ecx
lea ecx, [esp + 0xc8]
call fcn.00406ba0
mov esi, eax
mov ecx, 0x14
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x80]
cmp eax, 2
je 0x405fd3
cmp eax, 3
jne 0x406087
lea ecx, [esp + 0x114c]
call fcn.00482f00
lea ecx, [esp + 0x1154]
call fcn.00482f00
lea ecx, [esp + 0x115c]
call fcn.00482f00
mov esi, dword [esp + 0x54]
push 0
lea edx, [esp + 0x140]
push edx
push esi
call fcn.00441e10
test al, al
je 0x406087
lea ecx, [esp + 0x114c]
call fcn.00482e30
cmp eax, dword [esp + 0x6c]
jne 0x406087
cmp edx, dword [esp + 0x70]
jne 0x406087
mov eax, dword [esp + 0x113c]
cmp eax, dword [esp + 0x5c]
jne 0x406087
mov ecx, dword [esp + 0x1140]
cmp ecx, dword [esp + 0x60]
jne 0x406087
cmp byte [esp + 0xa0], 0
jne 0x406087
mov edx, dword [esp + 0x64]
and edx, 0xffffffdf
push edx
push esi
call fcn.0043ccc0
test al, al
jne 0x40607a
push esi
push 0x4bf
call fcn.00475cc0
push eax
mov eax, dword [esp + 0x3c]
push eax
call fcn.004adf30
add esp, 0xc
push esi
push 0
call fcn.004a0990
call fcn.004a0fb0
mov eax, dword [esp + 0x38]
inc eax
mov dword [esp + 0x38], eax
cmp eax, dword [esp + 0x130]
jb 0x405fa0
cmp word [esp + 0xe14e], 0
lea eax, [esp + 0xe14e]
jne 0x4060b6
lea eax, [esp + 0x3212]
mov ecx, dword [ebx + 0x38]
push 0x800
push eax
add ecx, 0xb41a
push ecx
mov dword [esp + 0x24], eax
call fcn.0047fbe0
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x62d9], 0
je 0x40634c
mov ecx, dword [0x533b54]
push 0x200
lea eax, [esp + 0x2d860]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [esp + 0x18]
push edx
push 0x54
call fcn.004a1410
mov ecx, dword [ebx + 0x3c]
test ecx, ecx
je 0x406114
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
push 0xc5e8
mov dword [ebx + 0x3c], 0
call fcn.004c2bd0
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x2ec70], 0xe
test eax, eax
je 0x406141
mov ecx, eax
call fcn.00421d50
jmp 0x406143
xor eax, eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x2ec70], 3
mov byte [eax + 0x62d9], 1
mov ecx, dword [ebx + 0x38]
mov edx, dword [ecx + 0x83b0]
mov dword [eax + 0x83b0], edx
mov dword [eax + 0x739c], 1
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6144]
mov byte [eax + 0x6144], dl
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6152]
mov byte [eax + 0x6152], dl
mov ecx, dword [ebx + 0x38]
movzx edx, byte [ecx + 0x6195]
mov byte [eax + 0x6195], dl
mov ecx, 0x4d8804
sub eax, ecx
lea edx, [eax + 0xa3fa]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx + ecx], ax
add ecx, 2
test ax, ax
jne 0x4061b0
mov esi, dword [ebx + 0x38]
mov edi, dword [esp + 0x1c]
add esi, 0x5024
add edi, 0x5024
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x15], al
mov eax, dword [esp + 0x18]
push eax
movsw word es:[edi], word [esi]
call fcn.0043d340
mov esi, dword [esp + 0x18]
test al, al
jne 0x406230
mov edi, 0x2e
jmp 0x406200
mov ecx, dword [ebx + 0x38]
cmp word [ecx + 0x639c], di
je 0x40622b
push esi
call fcn.00492ae0
test al, al
sete al
mov byte [esp + 0x15], al
cmp al, 1
je 0x406230
push esi
call fcn.0043d340
test al, al
je 0x406200
jmp 0x406230
mov byte [esp + 0x15], 1
cmp byte [esp + 0x15], 0
mov byte [esp + 0x14], 0
jne 0x4062d6
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0xa3dc], 0
jne 0x406251
call fcn.004a0d70
push esi
mov esi, dword [esp + 0x20]
mov ecx, esi
call fcn.00421080
push 0x4d8800
lea ecx, [esi + 0xc41c]
call fcn.004801a0
mov eax, dword [0x51ff14]
push 0x5c48
mov dword [esp + 0x28], eax
call fcn.004c2bd0
add esp, 4
mov dword [esp + 0x40], eax
mov byte [esp + 0x2ec70], 0xf
test eax, eax
je 0x40629f
push esi
mov ecx, eax
call fcn.00439a10
mov edi, eax
jmp 0x4062a1
xor edi, edi
mov byte [esp + 0x2ec70], 3
push esi
mov ecx, edi
call fcn.0043b1e0
test edi, edi
je 0x4062c5
mov ecx, edi
call fcn.00439af0
push edi
call fcn.004c2162
add esp, 4
mov ecx, dword [esp + 0x24]
cmp ecx, dword [0x51ff14]
setne byte [esp + 0x14]
jmp 0x4062da
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.00401ba0
push esi
call fcn.004c2162
add esp, 4
lea edx, [esp + 0x2d85c]
push edx
call fcn.004a0830
call fcn.004a0fb0
cmp byte [esp + 0x14], 0
je 0x40634c
mov byte [esp + 0x2ec70], 2
lea ecx, [esp + 0x31f4]
call fcn.0040c270
mov byte [esp + 0x2ec70], 1
lea ecx, [esp + 0xf154]
call fcn.0040c270
mov byte [esp + 0x2ec70], 0x10
mov eax, dword [esp + 0x120]
test eax, eax
je 0x406347
push eax
call fcn.004c23c4
add esp, 4
jmp 0x406636
mov eax, dword [ebp + 0x10]
cmp word [eax], 0x4d
je 0x406365
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x6196], 0
je 0x4065ce
push 0x33f
call fcn.00475cc0
push eax
call fcn.004a08a0
push 1
push 0
lea ecx, [esp + 0xcc]
call fcn.004072c0
mov esi, dword [esp + 0x130]
or edi, 0xffffffff
lea ecx, [esp + 0xa8]
dec esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x24], edi
call fcn.0043e080
mov byte [esp + 0x2ec70], 0x13
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0x619a], 0
mov byte [esp + 0x15], 0
je 0x4063fc
call fcn.004219c0
test al, al
jne 0x4063fc
cmp dword [esp + 0x20], 0
jne 0x4063fc
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x6153], 0
jne 0x4063fc
cmp byte [eax + 0x6154], 0
jne 0x4063fc
mov edi, dword [esp + 0x130]
mov byte [esp + 0x15], 1
xor esi, esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], esi
cmp esi, edi
je 0x4065ba
test byte [esp + 0x20], 0xf
jne 0x406414
call fcn.004807d0
mov edx, dword [esp + 0x20]
push edx
lea ecx, [esp + 0xc8]
call fcn.00406ba0
mov esi, eax
mov ecx, 0x14
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x80]
cmp eax, 2
je 0x406447
cmp eax, 3
jne 0x4065a4
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x619a], 0
mov esi, dword [esp + 0x54]
jne 0x40646b
mov ecx, dword [esp + 0x64]
push ecx
call fcn.0043cc40
test al, al
jne 0x40646b
push esi
call fcn.0043d460
mov edx, dword [ebp + 0x10]
cmp word [edx + 2], 0x46
setne al
cmp byte [esp + 0xa0], 0
je 0x406519
test al, al
je 0x4065a4
mov eax, dword [ebx + 0x38]
mov cl, byte [eax + 0x619a]
test cl, cl
je 0x4064d1
cmp byte [esp + 0x15], 0
je 0x4064d1
push esi
call fcn.0043d340
test al, al
je 0x4065a4
push esi
lea ecx, [esp + 0xac]
call fcn.0043e140
lea ecx, [esp + 0xa8]
call fcn.0043d5b0
mov byte [esp + 0x13], 1
jmp 0x406568
cmp byte [eax + 0x6199], 0
je 0x406501
push esi
call fcn.0043cfc0
test al, al
je 0x4064ef
push esi
call fcn.0043d610
jmp 0x406564
push 0x91
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x406568
test cl, cl
je 0x406511
lea ecx, [esp + 0xa8]
call fcn.0043d5b0
push esi
call fcn.0043ce60
jmp 0x406564
mov eax, dword [ebx + 0x38]
cmp byte [eax + 0x619a], 0
push esi
je 0x40654f
call fcn.0043d340
test al, al
je 0x4065a4
push esi
lea ecx, [esp + 0xac]
call fcn.0043e140
push esi
push 0
call fcn.004a0990
call fcn.004a0fb0
jmp 0x4065a4
cmp byte [eax + 0x6199], 0
je 0x40655f
call fcn.0043e230
jmp 0x406564
call fcn.0043cde0
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x40657e
push esi
push 0
call fcn.004a0990
call fcn.004a0fb0
jmp 0x4065a4
push esi
push 0x202
call fcn.00475cc0
push eax
lea eax, [esp + 0x321a]
push eax
call fcn.004adf30
add esp, 0xc
mov ecx, 0x51ff10
call fcn.00433f70
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x40]
jne 0x406408
mov byte [esp + 0x2ec70], 3
lea ecx, [esp + 0xa8]
call fcn.0043e0e0
cmp byte [esp + 0xe109], 0
je 0x4065f2
mov ebx, dword [ebx + 0x38]
cmp dword [ebx + 0x6140], 0
je 0x4065f2
lea ecx, [esp + 0xe14e]
push ecx
push ebx
call fcn.0046bf70
mov byte [esp + 0x2ec70], 2
lea ecx, [esp + 0x31f4]
call fcn.0040c270
mov byte [esp + 0x2ec70], 1
lea ecx, [esp + 0xf154]
call fcn.0040c270
mov byte [esp + 0x2ec70], 0x14
mov eax, dword [esp + 0x120]
test eax, eax
je 0x406636
push eax
call fcn.004c23c4
add esp, 4
mov byte [esp + 0x2ec70], 0
mov eax, dword [esp + 0xc4]
test eax, eax
je 0x406652
push eax
call fcn.004c23c4
add esp, 4
mov dword [esp + 0x2ec70], 0xffffffff
lea ecx, [esp + 0x1b0b4]
call fcn.00478950
mov ecx, dword [esp + 0x2ec68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2ec50]
xor ecx, esp
call fcn.004c1c22
mov esp, ebp
pop ebp
ret 0xc