Function at 0x40c860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x2094
call fcn.0043f2f0
mov eax, dword [0x46d040]
xor eax, esp
mov dword [esp + 0x208c], eax
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov edx, dword [ebx + 4]
mov edi, dword [ebx]
test edx, edx
jne 0x40c890
cmp edi, 0x16
jb 0x40d6d9
mov ebp, edi
mov ecx, edx
sub ebp, 0x1000
sbb ecx, 0
mov dword [esp + 0x14], ecx
js 0x40c8a9
jg 0x40c8c0
test ebp, ebp
jne 0x40c8c0
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
nop
mov eax, edi
sub eax, ebp
sbb edx, ecx
mov dword [esp + 0x2c], edx
ja 0x40c8d7
cmp eax, 0x1000
ja 0x40c8d7
sub edi, ebp
jmp 0x40c8dc
mov edi, 0x1000
mov esi, dword [ebx + 0x38]
lea eax, [esp + 0x1098]
push edi
push eax
push ecx
push ebp
push dword [ebx + 0x44]
mov ecx, esi
call dword [0x44127c]
call esi
cmp eax, edi
jne 0x40d6e2
lea esi, [edi - 4]
test esi, esi
js 0x40c984
lea edx, [esp + 0x1099]
lea edi, [esp + 0x1098]
lea eax, ds:[esp + 0x109b]
movzx ecx, byte [eax + esi]
movzx eax, byte [esp + esi + 0x109a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + esi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x40c977
mov edi, dword ds:[ebx]
mov eax, esi
mov ecx, dword [ebx + 4]
sub edi, ebp
cdq
sbb ecx, dword [esp + 0x14]
sub edi, eax
sbb ecx, edx
mov dword [esp + 0x2c], ecx
jne 0x40c97e
jb 0x40c969
cmp edi, 0x16
jae 0x40c97e
lea edi, [esp + 0x1098]
lea edx, [esp + 0x1099]
sub esi, 1
js 0x40c984
jmp 0x40c914
nop
test esi, esi
jns 0x40c9c5
mov ecx, dword [esp + 0x14]
mov eax, ebp
or eax, ecx
je 0x40d6e2
mov edi, dword [ebx]
mov esi, edi
mov edx, dword [ebx + 4]
sub esi, ebp
mov eax, edx
sbb eax, ecx
mov dword [esp + 0x2c], eax
jne 0x40d6e2
jb 0x40c9b7
cmp esi, 0x10015
jae 0x40d6e2
sub ebp, 0xffd
jmp 0x40c89a
mov edi, dword [esp + 0x14]
add ebp, eax
mov esi, dword [ebx + 0x38]
lea eax, [esp + 0x98]
push 0x16
push eax
adc edi, edx
mov ecx, esi
push edi
push ebp
push dword [ebx + 0x44]
call dword [0x44127c]
call esi
cmp eax, 0x16
jne 0x40d69a
movzx ecx, byte [esp + 0x9b]
movzx eax, byte [esp + 0x9a]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x99]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x98]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6054b50
jne 0x40d6d9
test edi, edi
jl 0x40cbc2
jg 0x40ca49
nop word [eax + eax]
cmp ebp, 0x4c
jb 0x40cbc2
push 0x14
add ebp, 0xffffffec
lea eax, [esp + 0x88]
push eax
adc edi, 0xffffffff
push edi
lfence
mov esi, dword [ebx + 0x38]
mov ecx, esi
push ebp
push dword [ebx + 0x44]
call dword [0x44127c]
call esi
cmp eax, 0x14
jne 0x40cbc2
movzx ecx, byte [esp + 0x87]
movzx eax, byte [esp + 0x86]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x85]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x84]
shl ecx, 8
or ecx, eax
cmp ecx, 0x7064b50
jne 0x40cbc2
movzx eax, byte [esp + 0x93]
cdq
mov ecx, eax
mov esi, edx
movzx eax, byte [esp + 0x92]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x91]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x90]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x8f]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x8e]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x8d]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
movzx eax, byte [esp + 0x8c]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
mov edx, dword [ebx]
or ecx, eax
mov eax, dword [ebx + 4]
add edx, 0xffffffc8
adc eax, 0xffffffff
cmp esi, eax
ja 0x40d6d9
nop
jb 0x40cb6a
cmp ecx, edx
ja 0x40d6d9
push 0x38
lea eax, [esp + 0x50]
push eax
push esi
push ecx
lfence
mov esi, dword [ebx + 0x38]
mov ecx, esi
push dword [ebx + 0x44]
call dword [0x44127c]
call esi
cmp eax, 0x38
jne 0x40cbc2
movzx ecx, byte [esp + 0x4f]
movzx eax, byte [esp + 0x4e]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x4d]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x4c]
shl ecx, 8
or ecx, eax
cmp ecx, 0x6064b50
jne 0x40cbc2
mov eax, dword [ebx + 0x48]
mov dword [eax + 0x34], 1
movzx ecx, byte [esp + 0xa3]
movzx eax, byte [esp + 0xa2]
movzx esi, byte [esp + 0x9d]
movzx edi, byte [esp + 0xa7]
shl ecx, 8
or ecx, eax
shl esi, 8
movzx eax, byte [esp + 0xa0]
mov dword [ebx + 0x10], ecx
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esp + 0xa1]
shl ecx, 8
or ecx, eax
shl edi, 8
movzx eax, byte [esp + 0x9c]
or esi, eax
mov dword [esp + 0x20], ecx
movzx ecx, byte [esp + 0x9f]
movzx eax, byte [esp + 0x9e]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x38], esi
movzx eax, byte [esp + 0xa6]
or edi, eax
mov dword [esp + 0x14], ecx
movzx eax, byte [esp + 0xa5]
shl edi, 8
or edi, eax
movzx eax, byte [esp + 0xa4]
shl edi, 8
or edi, eax
movzx eax, byte [esp + 0xab]
cdq
mov ebp, eax
mov dword [esp + 0x30], edi
movzx eax, byte [esp + 0xaa]
mov ecx, edx
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0xa9]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0xa8]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
mov dword [esp + 0x3c], ecx
mov eax, dword [ebx + 0x48]
mov dword [esp + 0x34], ebp
cmp dword [eax + 0x34], 0
je 0x40d092
movzx ecx, byte [esp + 0x97]
movzx eax, byte [esp + 0x96]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x95]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x94]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x73]
cdq
mov dword [esp + 0x18], ecx
mov ebp, eax
movzx eax, byte [esp + 0x72]
mov ecx, edx
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x71]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x70]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x6f]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x6e]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x6d]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [esp + 0x6c]
shld ecx, ebp, 8
cdq
or ecx, edx
shl ebp, 8
or ebp, eax
mov dword [esp + 0x38], ecx
movzx eax, byte [esp + 0x6b]
cdq
mov esi, eax
mov dword [esp + 0x1c], ebp
movzx eax, byte [esp + 0x6a]
mov ecx, edx
shld ecx, esi, 8
cdq
shl esi, 8
or ecx, edx
or esi, eax
movzx eax, byte [esp + 0x69]
shld ecx, esi, 8
cdq
shl esi, 8
or ecx, edx
or esi, eax
movzx eax, byte [esp + 0x68]
shld ecx, esi, 8
cdq
shl esi, 8
or esi, eax
or ecx, edx
shld ecx, esi, 8
movzx eax, byte [esp + 0x67]
cdq
or ecx, edx
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x66]
shld ecx, esi, 8
cdq
or ecx, edx
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x65]
shld ecx, esi, 8
cdq
or ecx, edx
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x64]
shld ecx, esi, 8
cdq
or ecx, edx
shl esi, 8
or esi, eax
mov dword [esp + 0x34], ecx
movzx eax, byte [esp + 0x7b]
cdq
mov edi, eax
mov dword [esp + 0x20], esi
movzx eax, byte [esp + 0x7a]
mov ecx, edx
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x79]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x78]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x77]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x76]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x75]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esp + 0x74]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
mov dword [esp + 0x24], ecx
movzx eax, byte [esp + 0x57]
cdq
mov ecx, edx
mov dword [esp + 0x30], edi
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x56]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x55]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x54]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x53]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x52]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x51]
cdq
or dword [esp + 0x10], eax
or ecx, edx
mov eax, dword [esp + 0x10]
shld ecx, eax, 8
shl eax, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0x50]
cdq
or dword [esp + 0x10], eax
or ecx, edx
ja 0x40cf56
cmp dword [esp + 0x10], 0x2c
jb 0x40d6be
cmp dword ds:[esp + 0x18], 1
jne 0x40d6d0
cmp dword [esp + 0x38], 0
ja 0x40d3b2
jb 0x40cf7c
cmp ebp, 0xffffffff
ja 0x40d3b2
cmp dword [esp + 0x34], 0
mov dword [ebx + 0x10], ebp
ja 0x40d3b2
jb 0x40cf95
cmp esi, 0xffffffff
ja 0x40d3b2
cmp dword ds:[esp + 0x24], 0
ja 0x40d3a6
cmp edi, 0xffffffff
ja 0x40d3a6
movzx esi, byte [esp + 0x5f]
movzx eax, byte [esp + 0x5e]
movzx ecx, byte [esp + 0x63]
shl ecx, 8
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x5d]
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x5c]
shl esi, 8
or esi, eax
movzx eax, byte [esp + 0x62]
or ecx, eax
mov dword [esp + 0x38], esi
movzx eax, byte [esp + 0x61]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x60]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x83]
cdq
mov dword [esp + 0x14], ecx
mov ebp, eax
movzx eax, byte [esp + 0x82]
mov ecx, edx
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x81]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x80]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x7f]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x7e]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x7d]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ecx, edx
or ebp, eax
movzx eax, byte [esp + 0x7c]
shld ecx, ebp, 8
cdq
shl ebp, 8
or ebp, eax
or ecx, edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], ecx
mov eax, dword ds:[esp + 0x20]
cmp dword [esp + 0x1c], eax
jne 0x40d6d0
mov edx, dword [esp + 0x14]
mov eax, edx
or eax, esi
je 0x40d0c8
cmp esi, 1
jne 0x40d6d0
nop dword [eax]
cmp edx, esi
jne 0x40d6d0
mov esi, dword ds:[esp + 0x1c]
mov edx, 0x2e
mov eax, esi
mul edx
mov dword [esp + 0x18], eax
xor eax, eax
cmp eax, edx
jb 0x40d6be
ja 0x40d0f4
cmp edi, dword [esp + 0x18]
jb 0x40d6be
mov edx, edi
add edx, ebp
adc eax, ecx
cmp eax, dword [ebx + 4]
ja 0x40d6be
jb 0x40d113
cmp edx, dword [ebx]
ja 0x40d6be
mov dword ds:[ebx + 8], ebp
mov dword [ebx + 0xc], ecx
test esi, esi
je 0x40d671
mov eax, dword [ebx + 0x48]
mov dword [esp + 0x18], eax
cmp edi, dword [eax + 8]
jbe 0x40d160
lfence
mov esi, dword [ebx + 0x30]
mov ecx, esi
push edi
push dword [eax + 0xc]
push dword [eax]
push dword [ebx + 0x34]
call dword [0x44127c]
call esi
mov ecx, eax
test ecx, ecx
je 0x40d6a3
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov eax, dword [ebx + 0x48]
mov ecx, dword [ebx + 0x10]
add eax, 0x10
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
cmp ecx, dword [eax + 8]
jbe 0x40d1a9
push ecx
lfence
push dword [eax + 0xc]
mov esi, dword [ebx + 0x30]
mov ecx, esi
push dword [eax]
push dword [ebx + 0x34]
call dword [0x44127c]
call esi
mov ecx, eax
test ecx, ecx
je 0x40d6a3
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov dword ds:[eax + 4], ecx
mov eax, dword [ebx + 0x48]
mov ecx, dword [ebx + 0x10]
add eax, 0x20
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
cmp ecx, dword [eax + 8]
jbe 0x40d1f5
push ecx
lfence
push dword [eax + 0xc]
mov esi, dword [ebx + 0x30]
mov ecx, esi
push dword [eax]
push dword [ebx + 0x34]
call dword [0x44127c]
call esi
mov ecx, eax
test ecx, ecx
je 0x40d6a3
mov eax, dword [esp + 0x18]
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
lfence
mov eax, dword [ebx + 0x48]
mov esi, dword [ebx + 0x38]
mov ecx, esi
push edi
push dword [eax]
push dword [esp + 0x44]
push ebp
push dword [ebx + 0x44]
call dword [0x44127c]
call esi
cmp eax, edi
jne 0x40d69a
mov esi, dword [ebx + 0x48]
xor edx, edx
mov dword [esp + 0x18], edx
mov esi, dword [esi]
cmp dword [ebx + 0x10], edx
jbe 0x40d671
cmp edi, 0x2e
jb 0x40d6be
movzx ecx, byte ds:[esi + 3]
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
cmp ecx, 0x2014b50
jne 0x40d6be
mov eax, dword ds:[ebx + 0x48]
mov ecx, esi
sub ecx, dword [eax]
mov eax, dword [eax + 0x10]
mov dword [eax + edx*4], ecx
mov eax, dword [ebx + 0x48]
mov eax, dword [eax + 0x20]
mov dword [eax + edx*4], edx
movzx eax, byte [esi + 0x17]
cdq
mov ecx, eax
mov ebp, edx
movzx eax, byte [esi + 0x16]
shld ebp, ecx, 8
cdq
or ebp, edx
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x15]
shld ebp, ecx, 8
cdq
or ebp, edx
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x14]
cdq
shld ebp, ecx, 8
or ebp, edx
shl ecx, 8
or ecx, eax
mov dword [esp + 0x1c], ebp
movzx eax, byte [esi + 0x1b]
cdq
mov edi, eax
mov dword [esp + 0x14], ecx
movzx eax, byte [esi + 0x1a]
mov ebp, edx
shld ebp, edi, 8
cdq
or ebp, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 0x19]
shld ebp, edi, 8
cdq
or ebp, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 0x18]
shld ebp, edi, 8
cdq
or ebp, edx
shl edi, 8
or edi, eax
mov dword [esp + 0x20], ebp
movzx eax, byte [esi + 0x2d]
cdq
mov ebp, eax
mov dword [esp + 0x28], edi
movzx eax, byte [esi + 0x2c]
shld edx, ebp, 8
shl ebp, 8
mov dword [esp + 0x10], edx
cdq
or ebp, eax
mov eax, dword [esp + 0x10]
or eax, edx
shld eax, ebp, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esi + 0x2b]
cdq
shl ebp, 8
or ebp, eax
mov eax, dword [esp + 0x10]
or eax, edx
shld eax, ebp, 8
mov dword [esp + 0x10], eax
movzx eax, byte [esi + 0x2a]
shl ebp, 8
cdq
or ebp, eax
or dword [esp + 0x10], edx
movzx edx, byte [esi + 0x1d]
movzx eax, byte [esi + 0x1c]
mov dword [esp + 0x24], ebp
movzx ebp, byte [esi + 0x1f]
shl edx, 8
or edx, eax
shl ebp, 8
movzx eax, byte [esi + 0x1e]
or ebp, eax
mov dword [esp + 0x48], edx
mov eax, dword [ebx + 0x48]
mov edx, dword [esp + 0x1c]
cmp dword [eax + 0x38], 0
jne 0x40d51d
test ebp, ebp
je 0x40d51d
mov eax, dword [esp + 0x20]
cmp edx, eax
jb 0x40d3be
ja 0x40d39c
cmp ecx, edi
jbe 0x40d3be
mov dword [esp + 0x44], ecx
mov dword [esp + 0x40], edx
jmp 0x40d3c6
mov dword [ebx + 0x1c], 0xf
jmp 0x40d6e9
mov dword [ebx + 0x1c], 2
jmp 0x40d6e9
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x40]
cmp ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
jb 0x40d412
ja 0x40d3ea
mov eax, dword ds:[esp + 0x24]
cmp dword [esp + 0x44], eax
jbe 0x40d416
mov eax, dword [esp + 0x20]
cmp edx, eax
jb 0x40d402
ja 0x40d3f4
cmp ecx, edi
jbe 0x40d402
mov eax, ecx
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x14]
jmp 0x40d416
mov ecx, dword [esp + 0x20]
mov eax, edi
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x14]
jmp 0x40d416
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
jne 0x40d51d
cmp dword [esp + 0x10], 0
jne 0x40d51d
mov edi, dword ds:[esp + 0x48]
mov dword [esp + 0x10], 0
lea eax, [edi + 0x2e]
add eax, ebp
cmp eax, dword [esp + 0x30]
jbe 0x40d49d
push ebp
push 0
lfence
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword ds:[esp + 0x10], eax
test eax, eax
je 0x40d6a3
xor ecx, ecx
add edi, dword [esp + 0x34]
push ebp
adc ecx, dword [esp + 0x40]
add edi, 0x2e
push eax
adc ecx, 0
push ecx
push edi
lfence
mov edi, dword [ebx + 0x38]
mov ecx, edi
push dword [ebx + 0x44]
call dword [0x44127c]
call edi
cmp eax, ebp
jne 0x40d685
mov edi, dword [esp + 0x10]
jmp 0x40d4a2
add edi, 0x2e
add edi, esi
cmp ebp, 4
jb 0x40d6ac
movzx edx, byte ds:[edi + 3]
movzx eax, byte [edi + 2]
shl edx, 8
or edx, eax
lea eax, [edx + 4]
cmp eax, ebp
ja 0x40d6ac
movzx ecx, byte [edi + 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
cmp ecx, 1
je 0x40d4eb
add edi, 4
mov eax, 0xfffffffc
sub eax, edx
add edi, edx
add ebp, eax
jne 0x40d4a2
jmp 0x40d4ff
mov eax, dword [ebx + 0x48]
mov dword [eax + 0x34], 1
mov eax, dword [ebx + 0x48]
mov dword [eax + 0x38], 1
push dword [esp + 0x10]
push 0
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
nop dword [eax]
cmp ecx, 0xffffffff
jne 0x40d529
test edx, edx
je 0x40d57e
mov ebp, dword [esp + 0x20]
cmp edi, 0xffffffff
jne 0x40d536
test ebp, ebp
je 0x40d57e
movzx ecx, byte [esi + 0xd]
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
mov ecx, dword [esp + 0x14]
jne 0x40d570
nop dword [eax + eax]
cmp edi, ecx
jne 0x40d6be
cmp ebp, edx
jne 0x40d6be
or edi, ebp
je 0x40d57e
mov eax, ecx
or eax, edx
je 0x40d6be
movzx edi, byte [esi + 0x23]
movzx eax, byte [esi + 0x22]
shl edi, 8
or edi, eax
cmp edi, 0xffff
je 0x40d6d0
cmp edi, dword [esp + 0x38]
je 0x40d5a9
nop dword [eax]
cmp edi, 1
jne 0x40d6d0
cmp ecx, 0xffffffff
jne 0x40d5b6
test edx, edx
je 0x40d613
movzx eax, byte ds:[esi + 0x2d]
cdq
mov edi, eax
mov ecx, edx
movzx eax, byte [esi + 0x2c]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esi + 0x2b]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
movzx eax, byte [esi + 0x2a]
shld ecx, edi, 8
cdq
shl edi, 8
or ecx, edx
or edi, eax
add edi, dword [esp + 0x14]
adc ecx, dword [esp + 0x1c]
add edi, 0x1e
adc ecx, 0
cmp ecx, dword [ebx + 4]
ja 0x40d6be
jb 0x40d613
cmp edi, dword [ebx]
ja 0x40d6be
test byte [esi + 9], 0x20
jne 0x40d6c7
movzx edx, byte [esi + 0x21]
movzx eax, byte [esi + 0x20]
movzx ecx, byte [esi + 0x1f]
mov edi, dword [esp + 0x30]
shl edx, 8
or edx, eax
shl ecx, 8
movzx eax, byte [esi + 0x1e]
or ecx, eax
movzx eax, byte [esi + 0x1c]
add edx, ecx
movzx ecx, byte [esi + 0x1d]
shl ecx, 8
or eax, ecx
add eax, 0x2e
add eax, edx
cmp eax, edi
ja 0x40d6be
mov edx, dword [esp + 0x18]
sub edi, eax
inc edx
mov dword [esp + 0x30], edi
add esi, eax
mov dword [esp + 0x18], edx
cmp edx, dword [ebx + 0x10]
jb 0x40d232
mov ecx, ebx
call fcn.0040c340
mov eax, 1
jmp 0x40d6eb
push dword [esp + 0x10]
lfence
push 0
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebx + 0x1c], 0x14
jmp 0x40d6e9
mov dword [ebx + 0x1c], 0x10
jmp 0x40d6e9
push dword [esp + 0x10]
push 0
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebx + 0x1c], 9
jmp 0x40d6e9
mov dword [ebx + 0x1c], 5
jmp 0x40d6e9
mov dword [ebx + 0x1c], 0xa
jmp 0x40d6e9
mov dword [ebx + 0x1c], 8
jmp 0x40d6e9
mov dword [ebx + 0x1c], 7
xor eax, eax
mov ecx, dword [esp + 0x209c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00421733
add esp, 0x2094
ret