Function at 0x40ae4e
Capabilities:
Enumerate process modules
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x40a8
call fcn.004fc7f0
cmp byte [ecx + 0x64], 0
mov al, 1
jne 0x40b7b2
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x94]
lea edx, [esp + 0x80]
and dword [ecx], 0
mov dword [ecx + 4], 4
and dword [edx], 0
mov dword [edx + 4], 1
and dword [ecx + 8], 0
and dword [edx + 8], 0
call fcn.004047ea
lea esi, [esp + 0x2158]
lea edx, [esp + 0x218]
mov eax, 0x1010101
mov ecx, esi
mov dword [edx + 8], eax
mov dword [edx + 4], eax
mov dword [edx], eax
mov byte [edx + 0xc], 1
call fcn.004d47cf
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x18]
lea edi, [esp + 0x100]
xor ebx, ebx
movdqa xmm0, xmmword [eax]
lea esi, [eax + 0x10]
lea edx, [edx + eax + 1]
mov dword [edi], esi
mov dword [edi + 4], edx
mov dword [edi + 8], eax
pmovmskb esi, xmm0
not esi
mov word [edi + 0xc], si
mov dword [edi + 0x10], ecx
lea ecx, [esp + 0x100]
call fcn.00401079
test eax, eax
mov dword [esp + 4], edx
mov dword [esp + 0xc], ebx
je 0x40b35c
mov esi, dword [esp + 0x84]
mov edx, dword [esp + 0x88]
and dword [esp + 0x58], 0
mov dword [esp + 0x5c], 1
and dword [esp + 0x60], 0
lea ecx, [esp + 0x58]
add edx, esi
mov dword [esp + 8], esi
mov dword [esp + 0x10], edx
push esi
call fcn.00416a75
pop eax
mov edi, dword [esp + 4]
lea ecx, [esp + 0x218]
mov ebx, ecx
mov edx, dword [edi + 0xb8]
push dword [edi + 0xbc]
call fcn.00415dd0
pop eax
mov esi, dword [esp + 0x21c]
mov edx, dword [esp + 0x220]
lea ecx, [esp + 0x58]
add edx, esi
push esi
call fcn.00416a75
pop eax
mov ecx, dword [esp + 0x218]
mov edx, esi
call fcn.0043d0cd
mov edx, dword [esp + 0x5c]
mov esi, ebx
mov ecx, ebx
mov dword [esp + 0x8c], edx
push dword [esp + 0x60]
call fcn.0040477c
pop eax
lea ebx, [esp + 0x114]
mov edx, esi
mov ecx, ebx
call fcn.004be9ed
lea esi, [esp + 0x3c]
mov edx, ebx
mov ecx, esi
call fcn.004bebe2
lea ecx, [esp + 0x74]
mov edx, esi
call fcn.00409749
mov eax, dword [edi + 0xbc]
cmp eax, 0xf
mov dword [esp + 0x24], eax
jbe 0x40b1eb
and dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
and dword [esp + 0x30], 0
mov edx, dword [esp + 0x10]
lea esi, [esp + 0x28]
mov ecx, esi
push dword [esp + 8]
call fcn.00416a75
pop eax
mov edi, dword [esp + 4]
lea ecx, [esp + 0x64]
mov edx, dword [edi + 0xb8]
push dword [edi + 0xbc]
call fcn.00415dd0
pop eax
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [esp + 0x20], ecx
push 0x512d28
push 0x10
push 0
call fcn.004010e4
add esp, 0xc
add edx, eax
mov ecx, esi
push eax
call fcn.00416a75
pop eax
mov edx, dword [esp + 0x2c]
lea edi, [esp + 0x218]
mov ecx, edi
mov dword [esp + 0x1c], edx
push dword [esp + 0x30]
call fcn.0040477c
pop eax
lea ebx, [esp + 0x114]
mov edx, edi
mov ecx, ebx
call fcn.004be9ed
lea esi, [esp + 0xa0]
mov edx, ebx
mov ecx, esi
call fcn.004bebe2
mov ecx, edi
mov edx, esi
call fcn.00409749
xor ecx, ecx
xor esi, esi
mov dword [esp + 0x50], 0
inc esi
mov edx, esi
call fcn.0043d0cd
mov edx, dword [esp + 0x21c]
mov ecx, dword [esp + 0x220]
mov eax, dword [esp + 0x218]
mov dword [esp + 0x18], edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x70], eax
call fcn.0043d0cd
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
call fcn.0043d0cd
mov eax, dword [esp + 4]
mov eax, dword [eax + 0xbc]
cmp eax, 0x11
setae byte [esp + 0x20]
jb 0x40b218
and dword [esp + 0x28], 0
mov dword [esp + 0x2c], 1
and dword [esp + 0x30], 0
mov edx, dword [esp + 0x10]
lea esi, [esp + 0x28]
mov ecx, esi
push dword [esp + 8]
call fcn.00416a75
pop eax
mov eax, dword [esp + 4]
lea ecx, [esp + 0x64]
mov edx, dword [eax + 0xb8]
push dword [eax + 0xbc]
call fcn.00415dd0
pop eax
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [esp + 4], ecx
push 0x512d38
push 0x11
push 0
call fcn.004010e4
add esp, 0xc
add edx, eax
mov ecx, esi
push eax
call fcn.00416a75
pop eax
mov edx, dword [esp + 0x2c]
lea esi, [esp + 0x218]
mov ecx, esi
mov dword [esp + 8], edx
push dword [esp + 0x30]
call fcn.0040477c
pop eax
lea ebx, [esp + 0x114]
mov edx, esi
mov ecx, ebx
call fcn.004be9ed
lea edi, [esp + 0xa0]
mov edx, ebx
mov ecx, edi
call fcn.004bebe2
mov ecx, esi
mov edx, edi
call fcn.00409749
xor ecx, ecx
xor edx, edx
inc edx
call fcn.0043d0cd
mov edx, dword [esp + 0x21c]
mov ecx, dword [esp + 0x220]
mov eax, dword [esp + 0x218]
mov dword [esp + 0x14], edx
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 4]
mov dword [esp + 0x50], eax
call fcn.0043d0cd
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 8]
call fcn.0043d0cd
jmp 0x40b224
cmp eax, 0x11
mov dword [esp + 0x38], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x50], 0
setae byte [esp + 0x20]
xor eax, eax
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
jmp 0x40b21c
mov dword [esp + 0x14], esi
mov dword [esp + 0x54], 0
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x98]
mov esi, dword [esp + 0x78]
mov edx, dword [esp + 0x7c]
mov ebx, dword [esp + 0xc]
shl eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], edx
add eax, ecx
mov dword [esp + 0x90], eax
cmp ecx, dword [esp + 0x90]
je 0x40b320
mov dword [esp + 0xc], ebx
mov ebx, dword [ecx + 8]
imul eax, dword [ecx + 0xc], 0xc
mov dword [esp + 8], ecx
test eax, eax
je 0x40b314
mov esi, dword [ebx + 4]
mov edi, dword [ebx + 8]
mov dword [esp + 4], eax
mov ecx, esi
mov edx, edi
push dword [esp + 0x1c]
push dword [esp + 0x14]
call fcn.004bd1ec
pop ecx
pop edx
test al, al
je 0x40b2a5
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, dword [ecx]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
cmp eax, 0xf
jbe 0x40b2d3
mov ecx, esi
mov edx, edi
push dword [esp + 0x38]
push dword [esp + 0x1c]
call fcn.004bd1ec
pop ecx
pop edx
test al, al
je 0x40b2d3
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, dword [ecx]
mov dword [esp + 0xc], eax
cmp byte [esp + 0x20], 0
je 0x40b301
mov ecx, esi
mov edx, edi
push dword [esp + 0x54]
push dword [esp + 0x18]
call fcn.004bd1ec
pop ecx
pop edx
test al, al
je 0x40b301
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
or eax, dword [ecx]
mov dword [esp + 0xc], eax
jmp 0x40b305
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
add ebx, 0xc
add eax, 0xfffffff4
jmp 0x40b26e
mov ebx, dword [esp + 0xc]
add ecx, 0x10
jmp 0x40b252
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x14]
call fcn.0043d0cd
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x18]
call fcn.0043d0cd
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x10]
call fcn.0043d0cd
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x8c]
call fcn.0043d0cd
jmp 0x40aef8
test ebx, 0x13b002
jne 0x40b6b3
push 0x14
pop esi
push esi
push 0x512cca
lea ebx, [esp + 0x220]
push ebx
call fcn.004fea40
add esp, 0xc
lea eax, [ebx + esi]
mov dword [esp + 4], eax
push esi
push 0x512cde
push eax
call fcn.004fea40
add esp, 0xc
push 0x29
pop ecx
xor esi, esi
inc esi
mov edx, esi
call fcn.00403157
mov edi, eax
push 0x28
pop eax
push eax
push ebx
push edi
call fcn.004fea40
add esp, 0xc
xor eax, eax
mov edx, 0x512cf2
mov dword [esp + 0x10], edi
mov byte [edi + 0x28], al
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], esi
lea esi, [esp + 0xa0]
mov ecx, esi
push 0x2c
call fcn.004110e9
pop eax
mov edi, dword [esi + 4]
mov eax, dword [esi + 8]
lea esi, [esp + 0x114]
mov edx, 0x512d1e
mov ecx, esi
mov dword [esp + 8], edi
mov dword [esp + 0x24], eax
push 0xa
call fcn.004110e9
pop eax
mov eax, esi
mov esi, dword [esi + 4]
mov edx, dword [esp + 0x24]
mov ecx, edi
push dword [eax + 8]
mov edi, eax
push esi
xor eax, eax
inc eax
push eax
push 0
lea eax, [esp + 0x4c]
push eax
call fcn.0040a4d6
add esp, 0x14
mov ecx, dword [edi]
mov edx, esi
call fcn.0043d0cd
lea eax, [esp + 0xa0]
mov edx, dword [esp + 8]
mov ecx, dword [eax]
call fcn.0043d0cd
mov edx, dword [esp + 0x10]
movzx eax, byte [edx + 0x28]
shl eax, 3
xor ecx, ecx
inc ecx
mov dword [esp + 8], eax
call fcn.004022d7
push 0x14
pop esi
push esi
push 0x512c14
push edi
call fcn.004fea40
add esp, 0xc
mov ecx, 0x512c28
lea eax, [edi + esi]
push esi
push ecx
push eax
call fcn.004fea40
add esp, 0xc
push 0x29
pop ecx
xor edi, edi
inc edi
mov edx, edi
call fcn.00403157
mov esi, eax
push 0x28
pop eax
push eax
lea eax, [esp + 0x118]
push eax
push esi
call fcn.004fea40
add esp, 0xc
xor eax, eax
mov byte [esi + 0x28], al
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edi
push 0x14
pop esi
push esi
push 0x512c3c
push ebx
call fcn.004fea40
add esp, 0xc
push esi
mov eax, 0x512c28
push eax
push dword [esp + 0xc]
call fcn.004fea40
add esp, 0xc
push 0xa
pop ecx
lea edx, [esp + 0x114]
mov esi, ebx
mov edi, edx
rep movsd dword es:[edi], dword [esi]
push 0x28
pop eax
push eax
push edx
mov esi, edx
push ebx
call fcn.004fea40
add esp, 0xc
lea ecx, [esp + 0x218]
xor eax, eax
mov edx, ebx
mov byte [ecx + 0x28], al
lea ecx, [esp + 0x3c]
call fcn.0040306c
push 0x14
pop edi
push edi
push 0x512c50
push ebx
call fcn.004fea40
add esp, 0xc
mov eax, 0x512c64
push edi
push eax
push dword [esp + 0xc]
call fcn.004fea40
add esp, 0xc
push 0xa
pop ecx
mov edx, esi
mov edi, esi
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x28
pop eax
push eax
push edx
mov esi, edx
push ebx
call fcn.004fea40
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x218]
mov edx, ebx
mov byte [ecx + 0x28], al
lea ecx, [esp + 0x3c]
call fcn.0040306c
push 0x14
pop edi
push edi
push 0x512c78
push ebx
call fcn.004fea40
add esp, 0xc
push edi
mov eax, 0x512c64
push eax
push dword [esp + 0xc]
call fcn.004fea40
add esp, 0xc
push 0xa
pop ecx
mov edx, esi
mov edi, esi
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
push 0x28
pop eax
push eax
push edx
push ebx
call fcn.004fea40
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x218]
lea esi, [esp + 0x3c]
mov edx, ebx
mov byte [ecx + 0x28], al
mov ecx, esi
call fcn.0040306c
lea edi, [esp + 0xa0]
mov edx, 0x512c8c
mov ecx, edi
push 0x1b
call fcn.004110e9
pop eax
lea ecx, [esp + 0x218]
mov edx, 0x512ca7
push 0x23
call fcn.004110e9
pop eax
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 4], ecx
push 0
xor ebx, ebx
inc ebx
push ebx
push 2
push 0
push esi
call fcn.0040a4d6
add esp, 0x14
lea eax, [esp + 0x218]
mov edi, dword [eax + 4]
mov edx, dword [eax + 8]
mov ecx, edi
push 0
push ebx
push ebx
push 0
push esi
call fcn.0040a4d6
add esp, 0x14
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
imul esi, dword [esp + 0x44], 0x29
mov ebx, edx
test esi, esi
je 0x40b678
mov al, byte [ebx + 0x28]
cmp al, 2
je 0x40b678
add ebx, 0x29
add esi, 0xffffffd7
test al, 1
je 0x40b631
call fcn.0040230b
xor edx, edx
xor ecx, ecx
inc edx
call fcn.0043d0cd
mov ecx, dword [esp + 0x218]
mov edx, edi
call fcn.0043d0cd
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 4]
call fcn.0043d0cd
push 0x10
pop ebx
jmp 0x40b6a7
call fcn.0040230b
xor ebx, ebx
xor edx, edx
xor ecx, ecx
inc edx
call fcn.0043d0cd
mov ecx, dword [esp + 0x218]
mov edx, edi
call fcn.0043d0cd
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 4]
call fcn.0043d0cd
or ebx, dword [esp + 0xc]
mov eax, dword [esp + 8]
or eax, ebx
mov ebx, eax
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x2158]
call fcn.00401ed7
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0x84]
call fcn.0043d0cd
lea ecx, [esp + 0x94]
call fcn.004022a0
test bl, 1
je 0x40b6eb
mov byte [esi + 0x4c], 1
test bl, 2
je 0x40b6f4
mov byte [esi + 0x4d], 1
mov eax, ebx
test bl, 4
je 0x40b6ff
mov byte [esi + 0x4e], 1
mov ecx, eax
test cl, 8
je 0x40b70a
mov byte [esi + 0x4f], 1
mov ecx, eax
test cl, 0x10
je 0x40b715
mov byte [esi + 0x50], 1
mov ecx, eax
test cl, 0x20
je 0x40b720
mov byte [esi + 0x51], 1
mov ecx, eax
test cl, 0x40
je 0x40b72b
mov byte [esi + 0x52], 1
mov ecx, eax
test cl, cl
jns 0x40b735
mov byte [esi + 0x53], 1
bt eax, 8
mov ecx, eax
jae 0x40b741
mov byte [esi + 0x54], 1
bt eax, 9
mov ecx, eax
jae 0x40b74d
mov byte [esi + 0x55], 1
bt eax, 0xa
mov ecx, eax
jae 0x40b759
mov byte [esi + 0x56], 1
bt eax, 0xb
mov ecx, eax
jae 0x40b765
mov byte [esi + 0x57], 1
bt eax, 0xc
mov ecx, eax
jae 0x40b771
mov byte [esi + 0x58], 1
bt eax, 0xe
mov ecx, eax
jae 0x40b77d
mov byte [esi + 0x59], 1
bt eax, 0x11
mov ecx, eax
jae 0x40b789
mov byte [esi + 0x5a], 1
bt eax, 0x12
mov ecx, eax
jae 0x40b795
mov byte [esi + 0x5b], 1
bt eax, 0x14
mov ecx, eax
jae 0x40b7a1
mov byte [esi + 0x5c], 1
test eax, 0x13b002
je 0x40b7ba
mov byte [esi + 0x5c], 1
xor eax, eax
mov byte [esi + 0x64], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
lea ecx, [esp + 0x58]
lea edx, [esp + 0x74]
and dword [ecx], 0
mov dword [ecx + 4], 4
and dword [edx], 0
mov dword [edx + 4], 1
and dword [ecx + 8], 0
and dword [edx + 8], 0
call fcn.00406a6b
and dword [esp + 0x80], 0
mov eax, 0xffffe0c0
test eax, eax
je 0x40b801
and dword [esp + eax + 0x2158], 0
add eax, 4
jmp 0x40b7f0
call sub.kernel32.dll_GetCurrentProcessId
lea esi, [esp + 0x2158]
mov edi, eax
and dword [esi + 4], 0
xor ebx, ebx
mov ecx, esi
inc ebx
mov dword [esi], ebx
call fcn.0040384c
push edi
push eax
push 0x410
call dword [sym.imp.kernel32.dll_OpenProcess]
mov dword [esi + 4], eax
mov dword [esi], ebx
lea esi, [esp + 0x2158]
mov dword [esp + 0x1c], eax
mov ecx, esi
call fcn.0040384c
mov edi, 0x7d0
lea ecx, [esp + 0x80]
push ecx
push edi
lea ebx, [esp + 0x220]
push ebx
push eax
call dword [sym.imp.kernel32.dll_K32EnumProcessModules]
push 0x1f40
push ebx
push esi
call fcn.004fea40
add esp, 0xc
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x60]
mov dword [esi + 0x1f44], edi
mov dword [esp + 8], 0
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x7c]
shl ecx, 4
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x5c]
add ecx, eax
mov dword [esp + 0x38], eax
xor eax, eax
mov dword [esp + 0x10], ecx
lea ebx, [esp + 0x114]
cmp edi, eax
je 0x40baa2
lea ecx, [eax + 1]
mov dword [esp + 0x4098], ecx
mov edi, dword [esp + eax*4 + 0x2158]
test edi, edi
je 0x40baa2
mov eax, 0x104
push eax
push 0
push ebx
call fcn.004fd260
add esp, 0xc
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x40], eax
xor eax, eax
inc eax
mov dword [esp + 0x3c], eax
call fcn.0040384c
mov esi, eax
xor eax, eax
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa4], edi
inc eax
mov dword [esp + 0xa0], eax
call fcn.0040384c
mov edi, 0x104
push edi
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_K32GetModuleBaseNameA]
mov ecx, 0x104
call fcn.0043afb9
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
push edi
mov esi, 0x104
push ebx
push edx
call fcn.004fea40
add esp, 0xc
mov dword [esp + 0x44], esi
lea edi, [esp + 0xa0]
lea esi, [esp + 0x3c]
mov ecx, edi
mov edx, esi
call fcn.004031c9
mov ecx, esi
mov edx, edi
push 0x512d48
call fcn.00402e56
pop eax
mov esi, dword [esp + 0x40]
lea ecx, [esp + 0x28]
mov edx, esi
push dword [esp + 0x44]
call fcn.00415dd0
pop eax
mov ecx, dword [esp + 0x3c]
mov edx, esi
call fcn.0043d0cd
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x24], ecx
call fcn.0040232b
mov esi, edx
mov edx, dword [esp + 0x18]
lea ebx, [esp + 0x64]
mov edi, eax
mov ecx, ebx
push dword [esp + 0x14]
call fcn.00416640
pop eax
add esi, edi
mov ecx, ebx
mov edx, esi
push edi
call fcn.00416a75
pop eax
mov edx, dword [esp + 0x68]
lea edi, [esp + 0xa0]
mov ecx, edi
mov dword [esp + 0x20], edx
push dword [esp + 0x6c]
call fcn.0040477c
pop eax
lea ebx, [esp + 0x3c]
mov edx, edi
mov ecx, ebx
call fcn.004be9ed
lea esi, [esp + 0x100]
mov edx, ebx
mov ecx, esi
call fcn.004bebe2
mov ecx, edi
mov edx, esi
call fcn.00409749
mov eax, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0xc], eax
cmp ecx, dword [esp + 0x10]
je 0x40ba65
mov eax, dword [ecx + 8]
imul ebx, dword [ecx + 0xc], 0xc
mov dword [esp + 4], ecx
add ebx, eax
cmp eax, ebx
je 0x40ba5c
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
lea esi, [eax + 0xc]
push edi
push dword [esp + 0x10]
call fcn.004bd1ec
pop ecx
pop edx
test al, al
mov eax, esi
je 0x40ba2b
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, dword [ecx]
mov dword [esp + 8], eax
mov eax, esi
jmp 0x40ba2b
mov ecx, dword [esp + 4]
add ecx, 0x10
jmp 0x40ba18
mov ecx, dword [esp + 0xa0]
mov edx, dword [esp + 0xc]
call fcn.0043d0cd
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x20]
call fcn.0043d0cd
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
call fcn.0043d0cd
mov eax, dword [esp + 0x4098]
mov edi, dword [esp + 0x409c]
jmp 0x40b8a4
mov ecx, dword [esp + 0x1c]
call fcn.0040387c
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x18]
call fcn.0043d0cd
lea ecx, [esp + 0x58]
call fcn.004022a0
mov eax, dword [esp + 8]
test eax, 0x1a002
je 0x40bae5
mov esi, dword [esp + 0x34]
test al, 2
mov byte [esi + 0x5c], 1
je 0x40b7ac
mov byte [esi + 0x4d], 1
jmp 0x40b7ac
mov esi, dword [esp + 0x34]
mov al, 1
jmp 0x40b7ae