Function at 0x41c1e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48d729
mov eax, dword fs:[0]
push eax
sub esp, 0x910
mov eax, dword [str.CombineRgn]
xor eax, esp
mov dword [esp + 0x90c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [str.CombineRgn]
xor eax, esp
push eax
lea eax, [esp + 0x924]
mov dword fs:[0], eax
mov eax, dword [esp + 0x934]
mov ebp, dword [esp + 0x938]
xor ebx, ebx
mov edi, ecx
push ebx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x1c], ebx
call fcn.0046e8d8
push edx
push eax
push 0x49bf1c
lea ecx, [esp + 0x924]
push 0xb
push ecx
call fcn.0046efb1
add esp, 0x18
push ebx
mov esi, 0xf
push 0x49b852
lea ecx, [esp + 0x900]
mov dword [esp + 0x918], esi
mov dword [esp + 0x914], ebx
mov byte [esp + 0x904], bl
call fcn.004184f0
push 0xffffffffffffffff
mov dword [esp + 0x930], ebx
push ebx
push ebp
lea ecx, [esp + 0x8cc]
mov dword [esp + 0x8e4], esi
mov dword [esp + 0x8e0], ebx
mov byte [esp + 0x8d0], bl
call fcn.00418a10
mov dword [esp + 0x8f4], esi
mov dword [esp + 0x8f0], ebx
mov byte [esp + 0x8e0], bl
mov dword [esp + 0x8bc], esi
mov dword [esp + 0x8b8], ebx
mov byte [esp + 0x8a8], bl
mov byte [esp + 0x92c], 3
push ebx
push 0x49b852
lea ecx, [esp + 0x890]
mov dword [esp + 0x8a8], esi
mov dword [esp + 0x8a4], ebx
mov byte [esp + 0x894], bl
call fcn.004184f0
mov byte [esp + 0x92c], 4
mov eax, dword [edi + 0x54]
cmp eax, ebx
jbe 0x41c43f
cmp eax, 0x20
jae 0x41c43f
cmp dword [esp + 0x93c], ebx
jne 0x41c3fd
lea edx, [esp + 0x914]
push edx
lea ecx, [esp + 0x20]
call fcn.00418620
lea esi, [edi + 0x5c]
lea ecx, [esp + 0x1c]
lea eax, [esp + 0x3c]
mov byte [esp + 0x92c], 5
call fcn.0041d3d0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x8b0]
mov byte [esp + 0x938], 6
call fcn.00418a10
cmp dword [esp + 0x54], 0x10
jb 0x41c387
mov eax, dword [esp + 0x40]
push eax
call fcn.0046ddac
add esp, 4
mov byte [esp + 0x92c], 4
cmp dword [esp + 0x34], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
jb 0x41c3b3
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0046ddac
add esp, 4
mov ecx, dword [esp + 0x8b8]
sub ecx, dword [edi + 0x54]
push 0xffffffffffffffff
lea esi, [esp + 0x20]
lea edx, [esp + 0x8a8]
call fcn.00413650
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x904]
mov byte [esp + 0x938], 7
call fcn.00418a10
mov byte [esp + 0x92c], 4
cmp dword [esp + 0x34], 0x10
jb 0x41c43f
mov edx, dword [esp + 0x20]
push edx
jmp 0x41c437
push eax
xor ecx, ecx
lea esi, [esp + 0x20]
mov edx, ebp
call fcn.00413650
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x904]
mov byte [esp + 0x938], 8
call fcn.00418a10
mov byte [esp + 0x92c], 4
cmp dword [esp + 0x34], 0x10
jb 0x41c43f
mov eax, dword [esp + 0x20]
push eax
call fcn.0046ddac
add esp, 4
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x8f8]
lea eax, [esi + 0x1c]
push ecx
push eax
lea edi, [esp + 0x24]
call fcn.0041e3a0
add esp, 8
add esi, 0x5c
mov ecx, eax
lea eax, [esp + 0x5c]
mov byte [esp + 0x92c], 9
mov dword [esp + 0x78], esi
call fcn.0041d3d0
push eax
mov eax, dword [esp + 0x3c]
add eax, 0x1c
push eax
lea edi, [esp + 0x44]
mov byte [esp + 0x934], 0xa
call fcn.0041e3a0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x8e8]
mov byte [esp + 0x938], 0xb
call fcn.00418a10
cmp dword [esp + 0x54], 0x10
jb 0x41c4be
mov edx, dword [esp + 0x40]
push edx
call fcn.0046ddac
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x74], edi
jb 0x41c4e7
mov eax, dword [esp + 0x60]
push eax
call fcn.0046ddac
add esp, 4
mov byte [esp + 0x92c], 4
mov dword [esp + 0x74], esi
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
cmp dword [esp + 0x34], edi
jb 0x41c50e
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0046ddac
add esp, 4
mov edx, dword [esp + 0x8f0]
mov dword [esp + 0x80], edx
cmp dword [esp + 0x93c], ebx
jne 0x41c696
mov esi, dword [esp + 0x38]
cmp dword [esi + 0x58], ebx
je 0x41c546
push ebx
call fcn.0046e8d8
mov ecx, dword [esi + 0x58]
add esp, 4
xor esi, esi
add ecx, eax
adc esi, edx
jmp 0x41c54a
xor ecx, ecx
xor esi, esi
push esi
push ecx
push 0x49bf20
lea eax, [esp + 0x920]
push 0xb
push eax
call fcn.0046efb1
mov ecx, dword [esp + 0x4c]
add ecx, 0x38
push ecx
push ebp
lea edi, [esp + 0x38]
call fcn.0041e3a0
add esp, 0x1c
mov esi, dword [esp + 0x78]
mov ecx, eax
lea eax, [esp + 0x3c]
mov byte [esp + 0x92c], 0xc
call fcn.0041d3d0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x8b0]
mov byte [esp + 0x938], 0xd
call fcn.00418a10
cmp dword [esp + 0x54], 0x10
jb 0x41c5b8
mov edx, dword [esp + 0x40]
push edx
call fcn.0046ddac
add esp, 4
mov byte [esp + 0x92c], 4
cmp dword [esp + 0x34], 0x10
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
jb 0x41c5e4
mov eax, dword [esp + 0x20]
push eax
call fcn.0046ddac
add esp, 4
push 0x10
xor ecx, ecx
lea esi, [esp + 0x20]
lea edx, [esp + 0x8a8]
call fcn.00413650
push eax
lea ecx, [esp + 0x918]
lea edi, [esp + 0x60]
mov byte [esp + 0x930], 0xe
call fcn.0041e450
push ebp
push eax
lea edi, [esp + 0x48]
mov byte [esp + 0x938], 0xf
call fcn.0041e3a0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x8cc]
mov byte [esp + 0x938], 0x10
call fcn.00418a10
cmp dword [esp + 0x54], 0x10
jb 0x41c653
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0046ddac
add esp, 4
mov esi, 0x10
mov edi, 0xf
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x74], esi
jb 0x41c67c
mov edx, dword [esp + 0x60]
push edx
call fcn.0046ddac
add esp, 4
mov byte [esp + 0x92c], 4
cmp dword [esp + 0x34], esi
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
jmp 0x41c711
mov ecx, dword [esp + 0x38]
mov ecx, dword [ecx + 0x54]
push 0xffffffffffffffff
lea esi, [esp + 0x20]
mov edx, ebp
call fcn.00413650
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x8b0]
mov byte [esp + 0x938], 0x11
call fcn.00418a10
mov byte [esp + 0x92c], 4
cmp dword [esp + 0x34], edi
jb 0x41c6dd
mov edx, dword [esp + 0x20]
push edx
call fcn.0046ddac
add esp, 4
lea ecx, [esp + 0x8a4]
lea esi, [esp + 0x1c]
call fcn.0041d7d0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x8cc]
mov byte [esp + 0x938], 0x12
call fcn.00418a10
mov byte [esp + 0x92c], 4
cmp dword [esp + 0x34], edi
jb 0x41c720
mov eax, dword [esp + 0x20]
push eax
call fcn.0046ddac
add esp, 4
mov ecx, dword [esp + 0x8d4]
mov ebp, dword [esp + 0x80]
mov dword [esp + 0x7c], ecx
xor esi, esi
mov eax, esi
cdq
idiv ebp
mov dword [esp + esi*4 + 0x88], esi
mov edi, edx
cmp edi, dword [esp + 0x8f0]
jbe 0x41c750
call fcn.0046f8fc
cmp dword [esp + 0x8f4], 0x10
mov eax, dword [esp + 0x8e0]
jae 0x41c768
lea eax, [esp + 0x8e0]
movsx edx, byte [edi + eax]
mov dword [esp + esi*4 + 0x488], edx
inc esi
cmp esi, 0xff
jle 0x41c734
xor ecx, ecx
xor eax, eax
mov edx, dword [esp + eax + 0x88]
mov esi, dword [esp + eax + 0x488]
add esi, edx
add ecx, esi
and ecx, 0x800000ff
jns 0x41c7a2
dec ecx
or ecx, 0xffffff00
inc ecx
mov esi, dword [esp + ecx*4 + 0x88]
mov dword [esp + eax + 0x88], esi
add eax, 4
cmp eax, 0x400
mov dword [esp + ecx*4 + 0x88], edx
jl 0x41c780
xor edi, edi
xor eax, eax
xor ebp, ebp
cmp dword [esp + 0x7c], ebx
jle 0x41c91b
jmp 0x41c7e7
mov eax, dword [esp + 0x80]
inc ebp
and ebp, 0x800000ff
jns 0x41c7f8
dec ebp
or ebp, 0xffffff00
inc ebp
mov esi, dword [esp + ebp*4 + 0x88]
add eax, esi
and eax, 0x800000ff
jns 0x41c80f
dec eax
or eax, 0xffffff00
inc eax
mov ecx, dword [esp + eax*4 + 0x88]
mov dword [esp + 0x80], eax
lea eax, [esp + eax*4 + 0x88]
mov dword [esp + ebp*4 + 0x88], ecx
mov dword [eax], esi
cmp edi, dword [esp + 0x8d4]
jbe 0x41c83b
call fcn.0046f8fc
cmp dword [esp + 0x8d8], 0x10
mov eax, dword [esp + 0x8c4]
jae 0x41c853
lea eax, [esp + 0x8c4]
mov edx, dword [esp + ebp*4 + 0x88]
add edx, esi
and edx, 0x800000ff
jns 0x41c86c
dec edx
or edx, 0xffffff00
inc edx
mov cl, byte [esp + edx*4 + 0x88]
xor cl, byte [eax + edi]
or eax, 0xffffffff
sub eax, dword [esp + 0x89c]
mov byte [esp + 0x14], cl
cmp eax, 1
ja 0x41c88e
call fcn.00442b5c
mov esi, dword [esp + 0x89c]
inc esi
cmp esi, 0xfffffffe
jbe 0x41c8a0
call fcn.00442b5c
mov eax, dword [esp + 0x8a0]
cmp eax, esi
jae 0x41cb4d
mov ecx, dword [esp + 0x89c]
push ecx
push esi
lea ecx, [esp + 0x890]
call fcn.00418810
cmp esi, ebx
jbe 0x41c910
cmp dword [esp + 0x8a0], 0x10
mov eax, dword [esp + 0x88c]
jae 0x41c8e0
lea eax, [esp + 0x88c]
mov ecx, dword [esp + 0x89c]
mov dl, byte [esp + 0x14]
mov byte [eax + ecx], dl
cmp dword [esp + 0x8a0], 0x10
mov eax, dword [esp + 0x88c]
mov dword [esp + 0x89c], esi
jae 0x41c90d
lea eax, [esp + 0x88c]
mov byte [esi + eax], bl
inc edi
cmp edi, dword [esp + 0x7c]
jl 0x41c7e0
cmp dword [esp + 0x93c], ebx
jne 0x41cb76
cmp dword [esp + 0x8a0], 0x10
mov eax, dword [esp + 0x88c]
jae 0x41c940
lea eax, [esp + 0x88c]
mov edx, dword [esp + 0x89c]
push edx
push eax
lea esi, [esp + 0x24]
call fcn.0041d470
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x894]
mov byte [esp + 0x938], 0x13
call fcn.00418a10
mov byte [esp + 0x92c], 4
cmp dword [esp + 0x34], 0x10
jb 0x41c989
mov eax, dword [esp + 0x20]
push eax
call fcn.0046ddac
add esp, 4
push ebx
mov esi, 0xf
push 0x49b852
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
call fcn.004184f0
mov byte [esp + 0x92c], 0x14
push 1
push 0x49bf28
lea ecx, [esp + 0x64]
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
call fcn.004184f0
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x20]
push edx
lea ebx, [esp + 0x44]
lea eax, [esp + 0x890]
mov byte [esp + 0x934], 0x15
call fcn.0041cfd0
mov edi, dword [esp + 0x58]
push eax
lea eax, [esp + 0x8fc]
push eax
mov byte [esp + 0x934], 0x16
call fcn.0041e3a0
mov esi, 0x10
add esp, 8
cmp dword [esp + 0x34], esi
jb 0x41ca24
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0046ddac
add esp, 4
xor ebx, ebx
mov ebp, 0xf
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x74], esi
jb 0x41ca4a
mov edx, dword [esp + 0x60]
push edx
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x74], ebp
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
cmp dword [esp + 0x54], esi
jb 0x41ca69
mov eax, dword [esp + 0x40]
push eax
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x54], ebp
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x8a0], esi
jb 0x41ca8e
mov ecx, dword [esp + 0x88c]
push ecx
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8a0], ebp
mov dword [esp + 0x89c], ebx
mov byte [esp + 0x88c], bl
cmp dword [esp + 0x8bc], esi
jb 0x41cabc
mov edx, dword [esp + 0x8a8]
push edx
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8bc], ebp
mov dword [esp + 0x8b8], ebx
mov byte [esp + 0x8a8], bl
cmp dword [esp + 0x8f4], esi
jb 0x41caea
mov eax, dword [esp + 0x8e0]
push eax
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8f4], ebp
mov dword [esp + 0x8f0], ebx
mov byte [esp + 0x8e0], bl
cmp dword [esp + 0x8d8], esi
jb 0x41cb18
mov ecx, dword [esp + 0x8c4]
push ecx
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8d8], ebp
mov dword [esp + 0x8d4], ebx
mov byte [esp + 0x8c4], bl
cmp dword [esp + 0x910], esi
jb 0x41cb46
mov edx, dword [esp + 0x8fc]
push edx
call fcn.0046ddac
add esp, 4
mov eax, edi
jmp 0x41cfa2
cmp esi, ebx
jne 0x41c8c6
cmp eax, 0x10
mov eax, dword [esp + 0x88c]
mov dword [esp + 0x89c], ebx
jae 0x41cb6f
lea eax, [esp + 0x88c]
mov byte [eax], bl
jmp 0x41c910
cmp dword [esp + 0x89c], 0x1a
jbe 0x41ceab
push 0xa
xor ecx, ecx
lea esi, [esp + 0x20]
lea edx, [esp + 0x88c]
call fcn.00413650
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x41cba7
mov eax, dword [eax + 4]
jmp 0x41cbaa
add eax, 4
push eax
call fcn.0046f51f
add esp, 4
mov ebp, eax
cmp dword [esp + 0x34], esi
jb 0x41cbc8
mov eax, dword [esp + 0x20]
push eax
call fcn.0046ddac
add esp, 4
push 0xffffffffffffffff
mov ecx, 0x1a
lea esi, [esp + 0x60]
lea edx, [esp + 0x88c]
call fcn.00413650
mov ecx, dword [esp + 0x38]
add ecx, 0x38
push ecx
push eax
lea edi, [esp + 0x44]
mov byte [esp + 0x934], 0x17
call fcn.0041e3a0
add esp, 8
mov esi, dword [esp + 0x78]
mov ecx, eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x92c], 0x18
call fcn.0041d3d0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x8b0]
mov byte [esp + 0x938], 0x19
call fcn.00418a10
mov esi, 0x10
cmp dword [esp + 0x34], esi
jb 0x41cc43
mov edx, dword [esp + 0x20]
push edx
call fcn.0046ddac
add esp, 4
mov edi, 0xf
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x54], esi
jb 0x41cc67
mov eax, dword [esp + 0x40]
push eax
call fcn.0046ddac
add esp, 4
mov byte [esp + 0x92c], 4
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x74], esi
jb 0x41cc8e
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0046ddac
add esp, 4
cmp ebp, ebx
je 0x41ccbd
push ebx
call fcn.0046e8d8
mov ecx, eax
mov esi, edx
mov eax, ebp
cdq
add esp, 4
sub eax, ecx
sbb edx, esi
mov dword [esp + 0x84], edx
js 0x41cd53
jg 0x41ccbd
cmp eax, ebx
jbe 0x41cd53
push 0x10
xor ecx, ecx
lea esi, [esp + 0x40]
lea edx, [esp + 0x8a8]
call fcn.00413650
mov edi, eax
mov byte [esp + 0x92c], 0x1a
push 0x10
mov ecx, 0xa
lea esi, [esp + 0x20]
lea edx, [esp + 0x88c]
mov dword [esp + 0x1c], 2
call fcn.00413650
cmp dword [edi + 0x18], 0x10
mov ebp, dword [edi + 0x14]
mov dword [esp + 0x18], 6
jb 0x41cd10
mov edi, dword [edi + 4]
jmp 0x41cd13
add edi, 4
mov esi, dword [eax + 0x14]
mov edx, esi
cmp edx, esi
jae 0x41cd1c
mov ecx, esi
cmp esi, ebp
jb 0x41cd24
mov ecx, ebp
cmp dword [eax + 0x18], 0x10
jb 0x41cd2f
mov edx, dword [eax + 4]
jmp 0x41cd32
lea edx, [eax + 4]
mov eax, ecx
mov ecx, edi
call fcn.00418420
cmp eax, ebx
jne 0x41cd53
cmp esi, ebp
jb 0x41cd53
xor eax, eax
cmp esi, ebp
setne al
mov byte [esp + 0x14], 1
cmp eax, ebx
je 0x41cd57
mov byte [esp + 0x14], bl
test byte [esp + 0x18], 4
mov edi, 0x10
je 0x41cd8e
and dword [esp + 0x18], 0xfffffffb
cmp dword [esp + 0x34], edi
jb 0x41cd7b
mov edx, dword [esp + 0x20]
push edx
call fcn.0046ddac
add esp, 4
mov ebp, 0xf
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
jmp 0x41cd93
mov ebp, 0xf
mov dword [esp + 0x92c], 4
test byte [esp + 0x18], 2
je 0x41cdb8
cmp dword [esp + 0x54], edi
jb 0x41cdb8
mov eax, dword [esp + 0x40]
push eax
call fcn.0046ddac
add esp, 4
cmp byte [esp + 0x14], bl
je 0x41ceab
mov esi, dword [esp + 0x58]
push 0xffffffffffffffff
mov ecx, 0x1a
lea edx, [esp + 0x88c]
call fcn.00413650
cmp dword [esp + 0x8a0], edi
jb 0x41cdf2
mov ecx, dword [esp + 0x88c]
push ecx
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8a0], ebp
mov dword [esp + 0x89c], ebx
mov byte [esp + 0x88c], bl
cmp dword [esp + 0x8bc], edi
jb 0x41ce20
mov edx, dword [esp + 0x8a8]
push edx
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8bc], ebp
mov dword [esp + 0x8b8], ebx
mov byte [esp + 0x8a8], bl
cmp dword [esp + 0x8f4], edi
jb 0x41ce4e
mov eax, dword [esp + 0x8e0]
push eax
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8f4], ebp
mov dword [esp + 0x8f0], ebx
mov byte [esp + 0x8e0], bl
cmp dword [esp + 0x8d8], edi
jb 0x41ce7c
mov ecx, dword [esp + 0x8c4]
push ecx
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8d8], ebp
mov dword [esp + 0x8d4], ebx
mov byte [esp + 0x8c4], bl
cmp dword [esp + 0x910], edi
jb 0x41cfa0
mov edx, dword [esp + 0x8fc]
push edx
jmp 0x41cf98
mov esi, dword [esp + 0x58]
push ebx
mov ebp, 0xf
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
push 0x49b852
mov ecx, esi
mov byte [esi + 4], bl
call fcn.004184f0
mov edi, 0x10
cmp dword [esp + 0x8a0], edi
jb 0x41cee8
mov eax, dword [esp + 0x88c]
push eax
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8a0], ebp
mov dword [esp + 0x89c], ebx
mov byte [esp + 0x88c], bl
cmp dword [esp + 0x8bc], edi
jb 0x41cf16
mov ecx, dword [esp + 0x8a8]
push ecx
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8bc], ebp
mov dword [esp + 0x8b8], ebx
mov byte [esp + 0x8a8], bl
cmp dword [esp + 0x8f4], edi
jb 0x41cf44
mov edx, dword [esp + 0x8e0]
push edx
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8f4], ebp
mov dword [esp + 0x8f0], ebx
mov byte [esp + 0x8e0], bl
cmp dword [esp + 0x8d8], edi
jb 0x41cf72
mov eax, dword [esp + 0x8c4]
push eax
call fcn.0046ddac
add esp, 4
mov dword [esp + 0x8d8], ebp
mov dword [esp + 0x8d4], ebx
mov byte [esp + 0x8c4], bl
cmp dword [esp + 0x910], edi
jb 0x41cfa0
mov ecx, dword [esp + 0x8fc]
push ecx
call fcn.0046ddac
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x924]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x90c]
xor ecx, esp
call fcn.0046ddb7
add esp, 0x91c
ret 0xc