Function at 0x409eb0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x9b0
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp byte [edx], 0
je 0x40a280
mov eax, dword [edi + 0xd4]
mov dword [esp + 0x78], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0x708], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xbc], 0
mov dword [esp + 0x70c], 0
test eax, eax
je 0x409f93
lea ecx, [esp + 0x28]
lea edx, [esp + 0x40]
lea esi, [esp + 0x78]
push ecx
push edx
push esi
push esi
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_GetProcessTimes]
test eax, eax
jne 0x409f93
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x409f93
lea eax, [esp + 0x298]
push eax
call fcn.0040ce40
add esp, 4
lea eax, [esp + 0x708]
lea ecx, [esp + 0xb8]
lea edx, [esp + 0x60]
push eax
push ecx
push edx
call dword [sym.imp.kernel32.dll_GetSystemTimes]
mov dword [esp + 0x18], eax
test eax, eax
mov eax, 0
jne 0x409fd7
call fcn.0040cfb0
mov dword [esp + 0x294], eax
mov eax, 1
mov dword [esp + 0x20], edx
mov dword [esp + 0x298], edx
mov ecx, dword [esp + 0xbc]
mov dword [esp + 0x290], eax
mov ebx, dword [esp + 0xb8]
mov eax, dword [edi + 0x60]
mov edx, dword [edi + 0x64]
movd xmm2, dword [esp + 0x708]
cmp ebx, eax
mov esi, ecx
movd xmm0, ebx
movd xmm1, ecx
sbb esi, edx
mov esi, 0
punpckldq xmm0, xmm2
movd xmm2, dword [esp + 0x44]
cmovb eax, esi
cmovb edx, esi
sub ebx, eax
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x70c]
sbb ecx, edx
mov edx, dword [edi + 0x68]
mov dword [esp + 0x10], ecx
mov ecx, edi
mov edi, dword [edi + 0x6c]
movd xmm3, ebx
mov eax, ebx
punpckldq xmm1, xmm3
movd xmm3, dword [esp + 0x28]
punpckldq xmm0, xmm1
pshufd xmm1, xmm0, 0xee
movd esi, xmm1
movd xmm1, dword [esp + 0x2c]
cmp esi, edx
sbb eax, edi
mov eax, 0
cmovb edx, eax
cmovb edi, eax
mov eax, 0xffffffff
sub esi, edx
punpckldq xmm2, xmm1
movd xmm1, dword [esp + 0x40]
mov edx, dword [ecx + 0x5c]
sbb ebx, edi
add esi, dword [esp + 0xc]
mov edi, dword [ecx + 0x50]
punpckldq xmm1, xmm3
adc ebx, dword [esp + 0x10]
punpckldq xmm1, xmm2
cmovb esi, eax
cmovb ebx, eax
mov eax, esi
or eax, ebx
mov eax, dword [ecx + 0x58]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x54]
movdqu xmmword [ecx + 0x50], xmm1
movdqu xmmword [ecx + 0x60], xmm0
je 0x40a252
movd ecx, xmm1
pshufd xmm0, xmm1, 0x55
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
cmp ecx, edi
movd ecx, xmm0
pshufd xmm0, xmm1, 0xff
pshufd xmm1, xmm1, 0xee
mov edx, ecx
sbb edx, eax
mov edx, 0
cmovb edi, edx
cmovb eax, edx
sub dword [esp + 0x10], edi
movd edi, xmm0
movd xmm0, esi
mov edx, edi
sbb ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
movd ecx, xmm1
movd xmm1, ebx
mov dword [esp + 0x24], ecx
punpckldq xmm0, xmm1
cmp ecx, eax
mov ecx, dword [esp + 0xc]
sbb edx, dword [esp + 0xc]
mov edx, 0
cmovb ecx, edx
cmovb eax, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
sub ecx, eax
sbb edi, dword [esp + 0xc]
movq qword [esp + 0xa8], xmm0
shr ebx, 0x1f
fild qword [esp + 0xa8]
fnstcw word [esp + 0x3e]
movzx eax, word [esp + 0x3e]
or eax, 0x300
mov word [esp + 0x5e], ax
mov eax, 0xffffffff
fldcw word [esp + 0x5e]
fadd dword [ebx*4 + 0x51a6a0]
add ecx, dword [esp + 0x10]
adc edi, dword [esp + 0x1c]
fldcw word [esp + 0x3e]
cmovb edi, eax
cmovb ecx, eax
movd xmm0, edi
movd xmm1, ecx
mov ecx, dword [ebp + 0x10]
shr edi, 0x1f
punpckldq xmm1, xmm0
movq qword [esp + 0xb0], xmm1
fild qword [esp + 0xb0]
fnstcw word [esp + 0x3c]
movzx eax, word [esp + 0x3c]
movd xmm0, ecx
or eax, 0x300
mov word [esp + 0x5c], ax
mov eax, dword [ebp + 0x14]
fldcw word [esp + 0x5c]
movd xmm1, eax
shr eax, 0x1f
fadd dword [edi*4 + 0x51a6a0]
fldcw word [esp + 0x3c]
punpckldq xmm0, xmm1
mov edi, dword [ebp + 8]
movq qword [esp + 0xa0], xmm0
fild qword [esp + 0xa0]
fnstcw word [esp + 0x3a]
movzx ecx, word [esp + 0x3a]
or ecx, 0x300
mov word [esp + 0x5a], cx
fldcw word [esp + 0x5a]
fadd dword [eax*4 + 0x51a6a0]
cmp dword [esp + 0x18], 0
fldcw word [esp + 0x3a]
fxch st(2)
fstp dword [esp + 0x8c]
fstp dword [esp + 0x84]
movss xmm0, dword [esp + 0x84]
divss xmm0, dword [esp + 0x8c]
fstp dword [esp + 0x88]
mulss xmm0, dword [0x519f44]
mulss xmm0, dword [esp + 0x88]
movss dword [edi + 0xd8], xmm0
je 0x40a266
jmp 0x40a27d
mov edi, dword [ebp + 8]
cmp dword [esp + 0x18], 0
mov dword [edi + 0xd8], 0
jne 0x40a27d
cmp dword [esp + 0x20], 0
je 0x40a27d
lea eax, [esp + 0x298]
push eax
call fcn.0040ce40
add esp, 4
mov edx, dword [ebp + 0xc]
cmp byte [edx + 1], 0
je 0x40a2fd
mov eax, dword [edi + 0xd4]
test eax, eax
je 0x40a2fd
lea ecx, [esp + 0x290]
push ecx
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_GetProcessIoCounters]
test eax, eax
je 0x40a2c8
movdqu xmm0, xmmword [edi + 0x90]
movdqu xmm1, xmmword [esp + 0x2a8]
movdqu xmmword [edi + 0x80], xmm0
movdqu xmmword [edi + 0x90], xmm1
jmp 0x40a2fa
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x70c], eax
mov dword [esp + 0x710], edx
mov dword [esp + 0x708], 1
je 0x40a2fa
lea eax, [esp + 0x710]
push eax
call fcn.0040ce40
add esp, 4
mov edx, dword [ebp + 0xc]
cmp byte [edx + 2], 0
je 0x40a3be
mov eax, dword [edi + 0xd4]
test eax, eax
je 0x40a3be
mov eax, dword [eax + 8]
pxor xmm0, xmm0
mov dword [esp + 0x2b4], 0
mov dword [esp + 0x2b0], 0
mov dword [esp + 0x2b8], 0
lea ecx, [esp + 0x290]
movdqa xmmword [esp + 0x2a0], xmm0
movdqa xmmword [esp + 0x290], xmm0
push 0x2c
push ecx
push eax
call dword [sym.imp.psapi.dll_GetProcessMemoryInfo]
test eax, eax
je 0x40a389
movdqu xmm0, xmmword [esp + 0x29c]
movd xmm1, dword [esp + 0x2b8]
punpckldq xmm0, xmm1
pxor xmm1, xmm1
punpckldq xmm0, xmm1
movdqu xmmword [edi + 0x40], xmm0
jmp 0x40a3bb
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x70c], eax
mov dword [esp + 0x710], edx
mov dword [esp + 0x708], 1
je 0x40a3bb
lea eax, [esp + 0x710]
push eax
call fcn.0040ce40
add esp, 4
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0xd4]
test eax, eax
je 0x40a686
movzx ecx, byte [edx + 3]
test ecx, ecx
je 0x40a686
cmp ecx, 1
je 0x40a3ea
cmp dword [edi + 0xc8], 0
jne 0x40a686
mov esi, dword [eax + 8]
call fcn.0040cd60
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push 8
push esi
call dword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x40a4bc
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x290]
mov dword [esp + 0x290], eax
push ebx
call fcn.0040cd70
add esp, 4
test al, al
jne 0x40a683
mov edi, dword [esp + 0x290]
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], 0
mov dword [esp + 0x60], edi
push eax
push 0
push 0
push 1
push edi
call dword [sym.imp.advapi32.dll_GetTokenInformation]
test eax, eax
je 0x40a5a4
mov esi, dword [esp + 0xb8]
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov dword [esp + 0x708], eax
lea eax, [esp + 0x708]
push eax
call fcn.0040cd70
add esp, 4
test al, al
je 0x40a4f7
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40a608
lea eax, [esp + 0x298]
jmp 0x40a5ff
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40a683
lea eax, [esp + 0x298]
push eax
call fcn.0040ce40
add esp, 4
jmp 0x40a683
push esi
push 8
push dword [esp + 0x710]
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x40a608
mov esi, eax
lea eax, [esp + 0xb8]
push eax
push dword [esp + 0xbc]
push esi
push 1
push edi
call dword [sym.imp.advapi32.dll_GetTokenInformation]
test eax, eax
je 0x40a647
push dword [esi]
push ebx
call fcn.0040c250
add esp, 8
mov ebx, dword [esp + 0x290]
test ebx, ebx
je 0x40ab18
mov eax, dword [esp + 0x298]
mov edi, dword [ebp + 8]
mov edx, dword [esp + 0x294]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0xc8]
test eax, eax
je 0x40a589
mov ecx, dword [edi + 0xcc]
test ecx, ecx
je 0x40a589
push 1
push ecx
push eax
mov dword [esp + 0x24], edx
call fcn.00402ca0
mov edx, dword [esp + 0x24]
add esp, 0xc
mov eax, dword [esp + 0xc]
mov dword [edi + 0xc8], ebx
mov dword [edi + 0xcc], edx
mov dword [edi + 0xd0], eax
jmp 0x40ab1b
call fcn.0040cfb0
mov dword [esp + 0x290], eax
mov dword [esp + 0x294], edx
push ebx
call fcn.0040ce30
add esp, 4
mov esi, eax
push 0x7a
call fcn.0040d250
add esp, 4
cmp esi, eax
mov eax, dword [esp + 0x294]
jne 0x40a5f4
test eax, eax
je 0x40a462
lea eax, [esp + 0x294]
push eax
call fcn.0040ce40
add esp, 4
jmp 0x40a462
test eax, eax
je 0x40a608
lea eax, [esp + 0x294]
push eax
call fcn.0040ce40
add esp, 4
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x40a680
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40a680
lea eax, [esp + 0x298]
push eax
call fcn.0040ce40
add esp, 4
jmp 0x40a680
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x290], eax
mov dword [esp + 0x294], edx
je 0x40a66e
lea eax, [esp + 0x294]
push eax
call fcn.0040ce40
add esp, 4
mov ecx, esi
call fcn.00409a70
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x40a613
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx + 7]
mov bl, 1
test ecx, ecx
je 0x40a69e
cmp ecx, 1
je 0x40a6f1
cmp dword [edi + 0xb4], 0
je 0x40a6f1
movzx eax, byte [edx + 6]
test eax, eax
je 0x40a6b4
cmp eax, 1
je 0x40a6f1
cmp dword [edi + 0xc0], 0
je 0x40a6f1
movzx eax, byte [edx + 4]
test eax, eax
je 0x40a6c7
cmp eax, 1
je 0x40a6f1
cmp byte [edi + 0x2c], 2
je 0x40a6f1
movzx eax, byte [edx + 5]
test eax, eax
je 0x40a6e1
cmp eax, 1
je 0x40a6f1
cmp byte [edi + 0x3c], 2
sete bl
test bl, bl
je 0x40a6e7
jmp 0x40a6f1
xor ebx, ebx
test bl, bl
jne 0x40a6f1
cmp byte [ebp + 0x20], 0
je 0x40a9e1
mov eax, dword [edi + 0xd4]
test eax, eax
je 0x40a9e1
mov esi, dword [eax + 8]
mov dword [esp + 0xc], ecx
lea eax, [esp + 0x90]
push 0
push 4
push eax
push 0x1a
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x40a9de
mov ecx, dword [esp + 0x90]
test ecx, ecx
je 0x40a83e
test bl, bl
je 0x40a9de
lea eax, [esp + 0x290]
push 0
push 0x470
push eax
push ecx
push esi
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x40a956
lea eax, [esp + 0x708]
push 0
push 0x2a4
push eax
push dword [esp + 0x2ac]
push esi
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x40a981
movzx eax, word [esp + 0x72c]
mov ecx, dword [esp + 0x750]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x730]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
test al, al
je 0x40ac0b
mov edx, dword [esp + 0x74c]
movzx ebx, word [esp + 0x748]
movzx eax, al
cmp eax, 1
je 0x40a7cc
cmp dword [edi + 0xb4], 0
jne 0x40ac0b
mov dword [esp + 0x14], ebx
mov eax, dword [section..data]
mov dword [esp + 0xc], ecx
cmp eax, 2
jne 0x40ab31
cmp byte [0x529004], 0
lea ebx, [edi + 0xac]
je 0x40ab5a
lea ecx, [esp + 0xb8]
mov edx, esi
call fcn.0040bb80
push ebx
call fcn.00406860
add esp, 4
mov eax, dword [edi + 0xb0]
test eax, eax
je 0x40a829
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebx]
call fcn.00402ca0
add esp, 0xc
mov eax, dword [esp + 0xc0]
movq xmm0, qword [esp + 0xb8]
jmp 0x40ac00
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x60]
push 0
push 0x18
push eax
push 0
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x40a9de
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x64]
xor edx, edx
test ecx, ecx
setne dl
test bl, bl
mov dword [edi], edx
mov dword [edi + 4], ecx
je 0x40a9de
lea ecx, [esp + 0xb8]
push 0
push 0x1d8
push ecx
push eax
push esi
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x40a9ac
lea edi, [esp + 0x708]
push 0
push 0x2a4
push edi
push dword [esp + 0xd4]
push esi
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x40aade
lea eax, [esp + 0x290]
push 0x2a4
push edi
push eax
call fcn.0043b9a0
add esp, 0xc
mov eax, dword [esp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40ae76
cmp eax, 1
je 0x40a8f3
cmp dword [edi + 0xb4], 0
jne 0x40ae76
mov eax, dword [section..data]
cmp eax, 2
jne 0x40ada0
cmp byte [0x529004], 0
mov ebx, edi
lea edi, [edi + 0xac]
je 0x40adc7
lea ecx, [esp + 0x28]
mov edx, esi
call fcn.0040bb80
push edi
call fcn.00406860
add esp, 4
mov eax, dword [ebx + 0xb0]
test eax, eax
je 0x40a947
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [edi]
call fcn.00402ca0
add esp, 0xc
mov eax, dword [esp + 0x30]
movq xmm0, qword [esp + 0x28]
jmp 0x40ae6c
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x70c], eax
mov dword [esp + 0x710], edx
mov dword [esp + 0x708], 1
je 0x40a9de
lea eax, [esp + 0x710]
jmp 0x40a9d5
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], edx
mov dword [esp + 0xb8], 1
je 0x40a9de
lea eax, [esp + 0xc0]
jmp 0x40a9d5
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40a9de
lea eax, [esp + 0x298]
push eax
call fcn.0040ce40
add esp, 4
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 8]
mov esi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
test eax, eax
je 0x40aabb
cmp eax, 1
je 0x40aa02
cmp byte [edi + 0x1c], 2
jne 0x40aabb
mov edi, dword [edi + 0xd4]
test edi, edi
je 0x40aa79
lea eax, [esp + 0x290]
push 0x20a
push 0
push eax
call fcn.0043d590
add esp, 0xc
mov edi, dword [edi + 8]
call fcn.0040cd60
push 0x105
lea ecx, [esp + 0x294]
push ecx
push eax
push edi
call dword [sym.imp.psapi.dll_GetModuleFileNameExW]
lea edi, [esp + 0xb8]
lea edx, [esp + 0x290]
mov ecx, edi
push 0x105
call fcn.0040ba50
add esp, 4
lea eax, [esp + 0x708]
push edi
push eax
call fcn.00423d70
add esp, 8
mov edi, dword [ebp + 8]
cmp byte [edi + 0x1c], 2
jne 0x40aa8a
jmp 0x40aa9f
mov byte [esp + 0x714], 2
mov edi, dword [ebp + 8]
cmp byte [edi + 0x1c], 2
je 0x40aa9f
mov eax, dword [edi + 0x14]
test eax, eax
je 0x40aa9f
push 1
push eax
push dword [edi + 0x10]
call fcn.00402ca0
add esp, 0xc
movq xmm0, qword [esp + 0x708]
movq xmm1, qword [esp + 0x710]
movq qword [edi + 0x18], xmm1
movq qword [edi + 0x10], xmm0
xor eax, eax
sub ebx, dword [edi + 0x70]
sbb esi, dword [edi + 0x74]
cmovb ebx, eax
cmovb esi, eax
mov dword [edi + 0x7c], esi
mov dword [edi + 0x78], ebx
mov byte [edi + 0xdc], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.0040cfb0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40ab10
lea eax, [esp + 0x298]
push eax
call fcn.0040ce40
add esp, 4
mov edi, dword [ebp + 8]
jmp 0x40a9de
mov edi, dword [ebp + 8]
mov ecx, esi
call fcn.00409a70
lea eax, [esp + 0x60]
push eax
call fcn.00403ef0
jmp 0x40a4ef
push section..data
push section..data
mov ebx, edx
call fcn.0043f980
mov edx, ebx
add esp, 8
cmp byte [0x529004], 0
lea ebx, [edi + 0xac]
jne 0x40a7f5
lea eax, [esp + 0xb8]
push dword [esp + 0x14]
push edx
push esi
push eax
call fcn.0040b950
add esp, 0x10
mov edi, dword [esp + 0xb8]
test edi, edi
je 0x40abb2
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
push edi
call fcn.00403fc0
add esp, 4
lea ecx, [esp + 0x60]
mov edx, eax
call fcn.0040b7f0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40abca
add eax, eax
push 2
push eax
push edi
call fcn.00402ca0
add esp, 0xc
jmp 0x40abca
mov dword [esp + 0x60], 4
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
push ebx
call fcn.00406860
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xb0]
test eax, eax
je 0x40abf3
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebx]
call fcn.00402ca0
add esp, 0xc
mov eax, dword [esp + 0x68]
movq xmm0, qword [esp + 0x60]
mov edi, dword [ebp + 8]
mov dword [ebx + 8], eax
movq qword [ebx], xmm0
mov ecx, dword [esp + 0xc]
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 6]
test eax, eax
je 0x40b18b
cmp eax, 1
je 0x40ac2c
cmp dword [edi + 0xc0], 0
jne 0x40b18b
lea eax, [edi + 0xb8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xb8]
push 0x1c
push eax
push ecx
push esi
mov ebx, ecx
call dword [sym.imp.kernel32.dll_VirtualQueryEx]
test eax, eax
je 0x40ad33
mov eax, dword [esp + 0xb8]
lea ecx, [esp + 0x40]
sub eax, ebx
add eax, dword [esp + 0xc4]
push eax
push ebx
push esi
push ecx
call fcn.0040b950
add esp, 0x10
mov eax, dword [esp + 0x40]
test eax, eax
mov dword [esp + 0x24], eax
je 0x40ad43
push 1
push 0x51a790
lea eax, [esp + 0xc0]
push eax
call fcn.00439780
add esp, 0xc
movzx eax, word [esp + 0xc0]
test ax, ax
mov dword [esp + 0xc], eax
jne 0x40aff7
mov eax, dword [esp + 0xb8]
cmp eax, dword [esp + 0xbc]
je 0x40af64
movzx edx, byte [eax]
movzx ecx, dl
test dl, dl
mov dword [esp + 0xc], ecx
jns 0x40aff7
mov ecx, dword [esp + 0xc]
mov ebx, edi
movzx edi, byte [eax + 1]
and ecx, 0x1f
and edi, 0x3f
cmp dl, 0xdf
jbe 0x40ad90
mov dword [esp + 0xc], ecx
movzx ecx, byte [eax + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp dl, 0xf0
jb 0x40afd4
movzx eax, byte [eax + 3]
mov edx, dword [esp + 0xc]
shl ecx, 6
mov edi, ebx
and edx, 7
and eax, 0x3f
shl edx, 0x12
or eax, ecx
or edx, eax
mov eax, edx
cmp edx, 0x110000
jne 0x40afdf
jmp 0x40af64
mov dword [esp + 0x44], 0x51a6a8
mov dword [esp + 0x48], 0x29
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00406860
add esp, 4
mov eax, dword [edi + 0xbc]
test eax, eax
je 0x40ad6d
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebx]
call fcn.00402ca0
add esp, 0xc
mov dword [edi + 0xb8], 4
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0
jmp 0x40b188
shl ecx, 6
or ecx, edi
mov edi, ebx
mov dword [esp + 0xc], ecx
jmp 0x40aff7
push section..data
push section..data
call fcn.0043f980
add esp, 8
cmp byte [0x529004], 0
mov ebx, edi
lea edi, [edi + 0xac]
jne 0x40a916
movzx eax, word [esp + 0x2d0]
lea ecx, [esp + 0x28]
push eax
push dword [esp + 0x2d8]
push esi
push ecx
call fcn.0040b950
add esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x40ae21
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
push ebx
call fcn.00403fc0
add esp, 4
lea ecx, [esp + 0x40]
mov edx, eax
call fcn.0040b7f0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40ae39
add eax, eax
push 2
push eax
push ebx
call fcn.00402ca0
add esp, 0xc
jmp 0x40ae39
mov dword [esp + 0x40], 4
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
push edi
call fcn.00406860
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xb0]
test eax, eax
je 0x40ae62
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [edi]
call fcn.00402ca0
add esp, 0xc
mov eax, dword [esp + 0x48]
movq xmm0, qword [esp + 0x40]
mov dword [edi + 8], eax
movq qword [edi], xmm0
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 6]
test eax, eax
je 0x40b4f2
cmp eax, 1
je 0x40ae97
cmp dword [edi + 0xc0], 0
jne 0x40b4f2
lea ebx, [edi + 0xb8]
lea eax, [esp + 0x94]
push esi
lea ecx, [esp + 0x294]
push ecx
push eax
call fcn.00404f30
add esp, 0xc
mov eax, dword [esp + 0x94]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x40af7a
lea eax, [esp + 0x28]
push 1
push 0x51a790
push eax
call fcn.00439780
add esp, 0xc
movzx eax, word [esp + 0x30]
test ax, ax
mov dword [esp + 0x10], eax
jne 0x40b34a
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x2c]
je 0x40af64
movzx edx, byte [eax]
movzx ecx, dl
test dl, dl
mov dword [esp + 0x10], ecx
jns 0x40b34a
mov ecx, dword [esp + 0x10]
movzx edi, byte [eax + 1]
and ecx, 0x1f
and edi, 0x3f
cmp dl, 0xdf
jbe 0x40afc3
mov dword [esp + 0x10], ecx
movzx ecx, byte [eax + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp dl, 0xf0
jb 0x40b326
movzx eax, byte [eax + 3]
mov edx, dword [esp + 0x10]
shl ecx, 6
mov edi, dword [ebp + 8]
and edx, 7
and eax, 0x3f
shl edx, 0x12
or eax, ecx
or edx, eax
mov eax, edx
cmp edx, 0x110000
jne 0x40b332
push 0x51a7bc
push 0x2b
push 0x51a791
call fcn.00442910
add esp, 0xc
ud2
push ebx
call fcn.00406860
add esp, 4
mov eax, dword [edi + 0xbc]
test eax, eax
je 0x40afa0
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebx]
call fcn.00402ca0
add esp, 0xc
mov dword [edi + 0xb8], 4
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0
jmp 0x40b4ef
shl ecx, 6
or ecx, edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], ecx
jmp 0x40b34a
mov eax, dword [esp + 0xc]
mov edi, ebx
shl eax, 0xc
or eax, ecx
cmp eax, 0xffff
jbe 0x40aff3
add eax, 0xff0000
shr eax, 0xa
or eax, 0xd800
mov dword [esp + 0xc], eax
mov ecx, edi
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov edi, dword [edi + 0xb8]
mov ebx, dword [ecx + 0xc0]
mov dword [ecx + 0xc0], 0
mov dword [esp + 0x50], eax
mov dword [esp + 0x20], edx
test ebx, ebx
je 0x40b044
add edi, 4
jmp 0x40b02e
add edi, 0xc
dec ebx
je 0x40b044
mov eax, dword [edi]
test eax, eax
je 0x40b028
push 1
push eax
push dword [edi - 4]
call fcn.00402ca0
add esp, 0xc
jmp 0x40b028
mov ecx, dword [esp + 0x20]
lea eax, [ecx + ecx]
neg eax
mov dword [esp + 0x54], eax
xor eax, eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
je 0x40b16c
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x54]
xor ebx, ebx
xor edi, edi
lea eax, [eax + edx*2]
lea edx, [ecx + edx*2]
cmp word [eax + edi*2], 0
je 0x40b089
add ebx, 0xfffffffe
inc edi
cmp edx, ebx
jne 0x40b075
jmp 0x40b16c
mov edx, dword [esp + 0x1c]
add edx, edi
jb 0x40b698
cmp edx, dword [esp + 0x20]
ja 0x40b6ac
xor edx, edx
mov ecx, ebx
add ecx, edx
je 0x40b16c
mov ecx, dword [esp + 0xc]
cmp cx, word [eax + edx]
lea edx, [edx + 2]
jne 0x40b0a1
push edi
push eax
lea ebx, [esp + 0xc0]
push ebx
call fcn.0041b8f0
add esp, 0xc
push ebx
call fcn.00423d90
add esp, 4
push edx
push eax
lea ebx, [esp + 0x68]
push ebx
call fcn.00423f90
add esp, 0xc
push ebx
lea eax, [esp + 0x2c]
push eax
call fcn.00408ad0
add esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc0]
cmp eax, dword [ebx + 0xbc]
jne 0x40b114
push eax
push dword [esp + 0x18]
call fcn.004063f0
add esp, 8
mov eax, dword [ebx + 0xc0]
mov ecx, dword [ebx + 0xb8]
mov edx, dword [esp + 0x30]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 + 8], edx
movq xmm0, qword [esp + 0x28]
movq qword [ecx + eax*4], xmm0
inc dword [ebx + 0xc0]
mov eax, dword [esp + 0xbc]
test eax, eax
je 0x40b153
push 1
push eax
push dword [esp + 0xc0]
call fcn.00402ca0
add esp, 0xc
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [edx + edi + 1]
cmp eax, ecx
jbe 0x40b053
jmp 0x40b4be
mov eax, dword [esp + 0x50]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40b188
add eax, eax
push 2
push eax
push dword [esp + 0x2c]
call fcn.00402ca0
add esp, 0xc
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 4]
test eax, eax
je 0x40b19c
cmp eax, 1
jne 0x40b1a0
mov cl, 1
jmp 0x40b1a7
xor ecx, ecx
jmp 0x40b1a7
cmp byte [edi + 0x2c], 2
sete cl
movzx ebx, byte [edx + 5]
test ebx, ebx
je 0x40b1bd
cmp ebx, 1
je 0x40b1c9
cmp byte [edi + 0x3c], 2
sete al
jmp 0x40b1bf
xor eax, eax
or al, cl
cmp al, 1
jne 0x40a9e1
lea eax, [edi + 0x20]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push dword [esp + 0x18]
push dword [esp + 0x14]
push esi
push eax
call fcn.0040b950
add esp, 0x10
mov edx, dword [esp + 0x28]
test edx, edx
je 0x40b2ba
mov ecx, dword [esp + 0x2c]
lea eax, [edi + 0x30]
lea esi, [esp + 0xb8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
mov ecx, esi
push dword [esp + 0x30]
call fcn.0040ba50
add esp, 4
lea edi, [esp + 0x60]
push esi
push edi
call fcn.00423d70
add esp, 8
push edi
call fcn.00423d90
add esp, 4
mov esi, edx
movzx ecx, bl
mov edx, eax
push dword [esp + 0x10]
push esi
call fcn.0040b6f0
add esp, 8
cmp byte [esp + 0xc], 0
je 0x40b2e1
mov edi, dword [ebp + 8]
movsd xmm0, qword [esp + 0x60]
movsd xmm1, qword [esp + 0x68]
mov edx, dword [ebp + 0xc]
mov esi, dword [esp + 0x14]
cmp byte [edi + 0x2c], 2
movsd qword [esp + 0xc0], xmm1
movsd qword [esp + 0xb8], xmm0
je 0x40b299
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40b299
push 1
push eax
push dword [esi]
call fcn.00402ca0
mov edx, dword [ebp + 0xc]
add esp, 0xc
movq xmm0, qword [esp + 0xb8]
movq xmm1, qword [esp + 0xc0]
movq qword [esi + 8], xmm1
movq qword [esi], xmm0
mov esi, dword [esp + 0x18]
jmp 0x40b305
cmp byte [edi + 0x2c], 2
je 0x40b2d8
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40b2d8
push 1
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call fcn.00402ca0
add esp, 0xc
mov byte [edi + 0x2c], 2
jmp 0x40a9de
mov eax, dword [esp + 0x64]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [esp + 0x18]
test eax, eax
je 0x40b305
push 1
push eax
push dword [esp + 0x68]
call fcn.00402ca0
mov edx, dword [ebp + 0xc]
add esp, 0xc
test esi, esi
je 0x40a9e1
add esi, esi
push 2
push esi
push dword [esp + 0x24]
call fcn.00402ca0
mov edx, dword [ebp + 0xc]
add esp, 0xc
jmp 0x40a9e1
mov eax, dword [esp + 0x10]
mov edi, dword [ebp + 8]
shl eax, 0xc
or eax, ecx
cmp eax, 0xffff
jbe 0x40b346
add eax, 0xff0000
shr eax, 0xa
or eax, 0xd800
mov dword [esp + 0x10], eax
mov ecx, edi
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
mov edi, dword [edi + 0xb8]
mov ebx, dword [ecx + 0xc0]
mov dword [ecx + 0xc0], 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x24], edx
test ebx, ebx
je 0x40b3a1
add edi, 4
jmp 0x40b38b
add edi, 0xc
dec ebx
je 0x40b3a1
mov eax, dword [edi]
test eax, eax
je 0x40b385
push 1
push eax
push dword [edi - 4]
call fcn.00402ca0
add esp, 0xc
jmp 0x40b385
mov ecx, dword [esp + 0x24]
lea eax, [ecx + ecx]
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
cmp eax, ecx
mov dword [esp + 0x14], eax
je 0x40b4d3
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
xor ebx, ebx
xor edi, edi
lea eax, [eax + edx*2]
lea edx, [ecx + edx*2]
cmp word [eax + edi*2], 0
je 0x40b3e6
add ebx, 0xfffffffe
inc edi
cmp edx, ebx
jne 0x40b3d2
jmp 0x40b4d3
mov edx, dword [esp + 0x14]
add edx, edi
jb 0x40b6c0
cmp edx, dword [esp + 0x24]
ja 0x40b6d4
xor edx, edx
mov ecx, ebx
add ecx, edx
je 0x40b4d3
mov ecx, dword [esp + 0x10]
cmp cx, word [eax + edx]
lea edx, [edx + 2]
jne 0x40b3fe
push edi
push eax
lea ebx, [esp + 0x30]
push ebx
call fcn.0041b8f0
add esp, 0xc
push ebx
call fcn.00423d90
add esp, 4
push edx
push eax
lea ebx, [esp + 0x48]
push ebx
call fcn.00423f90
add esp, 0xc
push ebx
lea eax, [esp + 0x7c]
push eax
call fcn.00408ad0
add esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc0]
cmp eax, dword [ebx + 0xbc]
jne 0x40b46e
push eax
push dword [esp + 0x54]
call fcn.004063f0
add esp, 8
mov eax, dword [ebx + 0xc0]
mov ecx, dword [ebx + 0xb8]
mov edx, dword [esp + 0x80]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 + 8], edx
movq xmm0, qword [esp + 0x78]
movq qword [ecx + eax*4], xmm0
inc dword [ebx + 0xc0]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x40b4aa
push 1
push eax
push dword [esp + 0x30]
call fcn.00402ca0
add esp, 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
lea eax, [edx + edi + 1]
cmp eax, ecx
jbe 0x40b3b0
lea eax, [edx + edi + 1]
push 0x51a7cc
push ecx
push eax
call fcn.00442c30
add esp, 0xc
ud2
mov eax, dword [esp + 0x54]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40b4ef
add eax, eax
push 2
push eax
push dword [esp + 0x24]
call fcn.00402ca0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 4]
test eax, eax
je 0x40b503
cmp eax, 1
jne 0x40b507
mov dl, 1
jmp 0x40b50e
xor edx, edx
jmp 0x40b50e
cmp byte [edi + 0x2c], 2
sete dl
movzx ebx, byte [ecx + 5]
test ebx, ebx
je 0x40b528
mov ecx, dword [esp + 0x18]
cmp ebx, 1
je 0x40b538
cmp byte [edi + 0x3c], 2
sete al
jmp 0x40b52e
mov ecx, dword [esp + 0x18]
xor eax, eax
or al, dl
cmp al, 1
jne 0x40a73a
mov dword [esp + 0x10], edx
movzx edx, word [esp + 0x2b4]
lea eax, [edi + 0x20]
lea ecx, [esp + 0x78]
mov dword [esp + 0x14], eax
push edx
push dword [esp + 0x2bc]
push esi
push ecx
call fcn.0040b950
add esp, 0x10
mov edx, dword [esp + 0x78]
test edx, edx
je 0x40b625
mov ecx, dword [esp + 0x7c]
lea eax, [edi + 0x30]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x28]
push dword [esp + 0x80]
call fcn.0040ba50
add esp, 4
lea eax, [esp + 0x28]
lea edi, [esp + 0x40]
push eax
push edi
call fcn.00423d70
add esp, 8
push edi
call fcn.00423d90
add esp, 4
mov edi, edx
movzx ecx, bl
mov edx, eax
push dword [esp + 0x24]
push edi
call fcn.0040b6f0
add esp, 8
cmp byte [esp + 0x10], 0
je 0x40b650
mov edi, dword [ebp + 8]
movsd xmm0, qword [esp + 0x40]
movsd xmm1, qword [esp + 0x48]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
cmp byte [edi + 0x2c], 2
movsd qword [esp + 0x30], xmm1
movsd qword [esp + 0x28], xmm0
je 0x40b60e
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40b60e
push 1
push eax
push dword [ebx]
call fcn.00402ca0
mov ecx, dword [esp + 0x24]
add esp, 0xc
movq xmm0, qword [esp + 0x28]
movq xmm1, qword [esp + 0x30]
movq qword [ebx + 8], xmm1
movq qword [ebx], xmm0
jmp 0x40b672
cmp byte [edi + 0x2c], 2
je 0x40b643
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40b643
push 1
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call fcn.00402ca0
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov byte [edi + 0x2c], 2
jmp 0x40a73a
mov eax, dword [esp + 0x44]
mov edi, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
test eax, eax
je 0x40b672
push 1
push eax
push dword [esp + 0x48]
call fcn.00402ca0
mov ecx, dword [esp + 0x24]
add esp, 0xc
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40a73a
add eax, eax
push 2
push eax
push dword [esp + 0x28]
call fcn.00402ca0
mov ecx, dword [esp + 0x24]
add esp, 0xc
jmp 0x40a73a
push 0x51a7dc
push edx
push dword [esp + 0x24]
call fcn.00442d10
add esp, 0xc
ud2
push 0x51a7dc
push dword [esp + 0x24]
push edx
call fcn.00442ca0
add esp, 0xc
ud2
push 0x51a7dc
push edx
push dword [esp + 0x1c]
call fcn.00442d10
add esp, 0xc
ud2
push 0x51a7dc
push dword [esp + 0x28]
push edx
call fcn.00442ca0
add esp, 0xc
ud2