Function at 0x401090
Capabilities:
Create process on windows
Hide graphical window
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x184
mov eax, dword [0x40d00c]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x40d998
push 0x67
push edi
mov dword [esp + 0x40], edi
call esi
push 0x64
push 0x40d8d0
push 0x6d
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x6b
push edi
mov dword [esp + 0x4c], 0x30
mov dword [esp + 0x50], 3
mov dword [esp + 0x54], 0x401f90
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], edi
call esi
push 0x7f00
push 0
mov dword [esp + 0x64], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6b
push dword [esp + 0x5c]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 6
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0x40d8d0
call esi
mov dword [esp + 0x70], eax
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0x81
push edi
call dword [sym.imp.USER32.dll_LoadBitmapW]
push 0x40d8b4
push 0x18
push eax
mov dword [0x40d8cc], eax
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [0x40d8b8]
mov edi, dword [0x40d8bc]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [esp + 0x38], eax
call esi
push 1
mov dword [esp + 0x3c], eax
call esi
mov ecx, dword [esp + 0x34]
sub eax, edi
push 0
push dword [esp + 0x34]
cdq
push 0
push 0
push edi
sub eax, edx
sar eax, 1
push ecx
push eax
mov eax, dword [esp + 0x54]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
push 0x9008000e
push 0x40d998
push 0x40d8d0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x401eec
push dword [ebp + 0x14]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x40]
push eax
push 0x20019
push 0
push str.SOFTWAREWOW6432NodeCriterionBurnoutPR
push 0x80000002
call esi
test eax, eax
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 7
sete cl
xor edx, edx
mov word [esp + 0xb0], dx
test eax, eax
jne 0x401336
push eax
push 0x40a5e4
lea ecx, [esp + 0x98]
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], 7
mov word [esp + 0x98], ax
call fcn.004041b0
push 0xb
xor eax, eax
mov dword [esp + 0x24], 0
push str.Install_Dir
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
call fcn.004041b0
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0xb4]
push eax
lea edx, [esp + 0x18]
call fcn.004020f0
mov edx, dword [esp + 0x2c]
add esp, 8
cmp edx, 8
jb 0x4012d9
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4012cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401330
push edx
push ecx
call fcn.00407a25
add esp, 8
mov edx, dword [esp + 0xa4]
xor eax, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 7
mov word [esp + 0x10], ax
cmp edx, 8
jb 0x401424
mov ecx, dword [esp + 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40141a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40141a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
test cl, cl
jne 0x40142e
lea eax, [esp + 0x40]
push eax
push 0x20019
push 0
push str.SOFTWARECriterionBurnoutPR
push 0x80000002
call esi
test eax, eax
jne 0x40142e
push 0x40a5e4
lea ecx, [esp + 0x48]
call fcn.00404310
push str.Install_Dir
lea ecx, [esp + 0x14]
call fcn.00404310
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0xb4]
push eax
lea edx, [esp + 0x18]
call fcn.004020f0
mov edx, dword [esp + 0x2c]
add esp, 8
cmp edx, 8
jb 0x4013cf
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4013c5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401414
push edx
push ecx
call fcn.00407a25
add esp, 8
mov edx, dword [esp + 0x58]
xor eax, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 7
mov word [esp + 0x10], ax
cmp edx, 8
jb 0x401424
mov ecx, dword [esp + 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40141a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40141a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407a25
add esp, 8
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xd
xor eax, eax
mov dword [esp + 0x24], 0
push 0x40a4b8
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
call fcn.004041b0
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0xb4]
lea ecx, [esp + 0x48]
call fcn.00403500
mov edx, dword [esp + 0x28]
add esp, 4
cmp edx, 8
jb 0x4014ab
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4014a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4014a1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407a25
add esp, 8
push 0xd
xor eax, eax
mov dword [esp + 0x24], 0
push 0x40a4b8
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
call fcn.004041b0
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0xb4]
lea ecx, [esp + 0x94]
call fcn.00403500
mov edx, dword [esp + 0xa8]
add esp, 4
cmp edx, 8
jb 0x40152b
mov ecx, dword [esp + 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401521
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401579
push edx
push ecx
call fcn.00407a25
add esp, 8
mov edx, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], ax
cmp edx, 8
jb 0x401589
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40157f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40157f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407a25
add esp, 8
cmp dword [esp + 0x58], 8
lea eax, [esp + 0x44]
mov edi, dword [esp + 0x54]
cmovae eax, dword [esp + 0x44]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x38], eax
cmp edi, 8
jae 0x4015ce
movups xmm0, xmmword [eax]
mov dword [esp + 0x24], 7
mov esi, 7
movups xmmword [esp + 0x10], xmm0
jmp 0x40164e
mov esi, edi
mov eax, 0x7ffffffe
or esi, 7
cmp esi, eax
cmova esi, eax
lea eax, [esi + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x4015ef
or ecx, 0xffffffff
jmp 0x4015f7
cmp ecx, 0x1000
jb 0x40161e
lea eax, [ecx + 0x23]
or edx, 0xffffffff
cmp eax, ecx
cmovbe eax, edx
push eax
call fcn.00407a33
add esp, 4
test eax, eax
je 0x401330
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x401631
test ecx, ecx
je 0x40162f
push ecx
call fcn.00407a33
add esp, 4
mov ecx, eax
jmp 0x401631
xor ecx, ecx
lea eax, [edi*2 + 2]
mov dword [esp + 0x10], ecx
push eax
push dword [esp + 0x3c]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x90]
mov dword [esp + 0x20], edi
push ecx
lea ecx, [esp + 0x144]
mov dword [esp + 0x144], 0x44
push ecx
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
lea eax, [esp + 0x28]
push 0
cmp esi, 8
movlpd qword [esp + 0x160], xmm0
push 0
cmovae eax, dword [esp + 0x30]
push eax
push 0
movlpd qword [esp + 0x174], xmm0
movlpd qword [esp + 0x17c], xmm0
movlpd qword [esp + 0x184], xmm0
movlpd qword [esp + 0x18c], xmm0
movlpd qword [esp + 0x194], xmm0
movlpd qword [esp + 0x19c], xmm0
movlpd qword [esp + 0x1a4], xmm0
movaps xmmword [esp + 0xb8], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [esp + 0x90]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x94]
call esi
mov edx, dword [esp + 0x24]
cmp edx, 8
jb 0x401737
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40172d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40172d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407a25
add esp, 8
push 0x6d
push dword [esp + 0x34]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
xorps xmm0, xmm0
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x118]
movlpd qword [esp + 0x118], xmm0
movlpd qword [esp + 0x120], xmm0
movlpd qword [esp + 0x128], xmm0
movlpd qword [esp + 0x130], xmm0
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], 0
call fcn.00402a90
push 0xd
push str.BurnoutPR.exe
lea ecx, [esp + 0x98]
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0xf
mov byte [esp + 0x98], 0
call fcn.00404a50
push 0xb
xor eax, eax
mov dword [esp + 0x24], 0
push str.d3dMenu.dll
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
call fcn.004041b0
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0xb4]
lea ecx, [esp + 0xcc]
call fcn.00403500
mov edx, dword [esp + 0x28]
add esp, 4
cmp edx, 8
jb 0x401841
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401837
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401837
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407a25
add esp, 8
push 0xa
xor eax, eax
mov dword [esp + 0x24], 0
push str.config.xml
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
call fcn.004041b0
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0xb4]
lea ecx, [esp + 0xfc]
call fcn.00403500
mov edx, dword [esp + 0x28]
add esp, 4
cmp edx, 8
jb 0x4018c1
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4018b7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4018b7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407a25
add esp, 8
lea edx, [esp + 0xc8]
lea ecx, [esp + 0xe0]
call fcn.004021a0
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x74]
mov esi, dword [sym.imp.USER32.dll_PeekMessageW]
push 1
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x401939
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x3c]
push dword [esp + 0x7c]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x40191c
lea eax, [esp + 0x74]
push eax
call edi
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [esp + 0x78], 0x12
je 0x401939
push 1
push 0
push 0
push 0
lea eax, [esp + 0x84]
push eax
call esi
test eax, eax
jne 0x4018f3
call dword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov esi, eax
mov edi, edx
mov dword [esp + 0x34], esi
call dword [sym.imp.MSVCP140.dll__Query_perf_counter]
push ebx
push edi
push esi
push edx
push eax
call fcn.00408af0
mov esi, ebx
pop ebx
push 0
push 0x3b9aca00
push esi
push ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x40], edx
call fcn.00408bd0
push edi
push dword [esp + 0x38]
push edx
push eax
call fcn.00408a40
push 0
push 0x3b9aca00
push dword [esp + 0x38]
mov edi, eax
mov esi, edx
push dword [esp + 0x48]
call fcn.00408bd0
add edi, eax
push 0
adc esi, edx
sub edi, dword [0x40da60]
push 0xf4240
sbb esi, dword [0x40da64]
push esi
push edi
call fcn.00408a40
push 0
push str.BurnoutParadiseWindowClass
mov edi, eax
mov esi, edx
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
setne cl
mov byte [0x40d8b1], cl
test eax, eax
jne 0x4019e8
test esi, esi
jg 0x401cef
jl 0x4019e8
cmp edi, 0x493e0
jae 0x401cef
test cl, cl
je 0x401c7e
cmp byte [0x40d028], 0
je 0x401c7e
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x14]
call fcn.00403620
mov esi, dword [sym.imp.MSVCP140.dll_int___cdecl_std::_Execute_once_struct_std::once_flag___int____stdcall___void___void___void_____void__]
push 0x40da74
push 0x404a30
push 0x40da7c
call esi
add esp, 0xc
test eax, eax
je 0x401ce9
push 0x40da74
push 0x404a30
push 0x40da7c
call esi
add esp, 0xc
test eax, eax
je 0x401ce9
cmp dword [esp + 0x24], 8
lea ecx, [esp + 0x138]
mov edi, dword [sym.imp.MSVCP140.dll__Stat]
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push ecx
push eax
call edi
add esp, 8
cmp eax, 8
je 0x401a7d
mov byte [esp + 0xf], 0
cmp eax, 0xffffffff
jne 0x401a82
mov byte [esp + 0xf], 1
mov edx, dword [esp + 0x24]
cmp edx, 8
jb 0x401abe
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401ab4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401330
push edx
push ecx
call fcn.00407a25
add esp, 8
cmp byte [esp + 0xf], 0
jne 0x401cef
lea eax, [esp + 0xf8]
push eax
lea ecx, [esp + 0x14]
call fcn.00403620
push 0x40da74
push 0x404a30
push 0x40da7c
call esi
add esp, 0xc
test eax, eax
je 0x401ce9
push 0x40da74
push 0x404a30
push 0x40da7c
call esi
add esp, 0xc
test eax, eax
je 0x401ce9
cmp dword [esp + 0x24], 8
lea ecx, [esp + 0x13c]
lea eax, [esp + 0x10]
cmovae eax, dword [esp + 0x10]
push ecx
push eax
call edi
add esp, 8
cmp eax, 8
je 0x401b3d
mov byte [esp + 0xf], 0
cmp eax, 0xffffffff
jne 0x401b42
mov byte [esp + 0xf], 1
mov edx, dword [esp + 0x24]
cmp edx, 8
jb 0x401b7e
mov ecx, dword [esp + 0x10]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401b74
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401330
push edx
push ecx
call fcn.00407a25
add esp, 8
cmp byte [esp + 0xf], 0
jne 0x401cef
mov byte [0x40d028], 0
call dword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov esi, eax
mov edi, edx
mov dword [esp + 0x3c], esi
call dword [sym.imp.MSVCP140.dll__Query_perf_counter]
push ebx
push edi
push esi
push edx
push eax
call fcn.00408af0
mov esi, ebx
pop ebx
push 0
push 0x3b9aca00
push esi
push ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
call fcn.00408bd0
push edi
push dword [esp + 0x40]
push edx
push eax
call fcn.00408a40
push 0
push 0x3b9aca00
push dword [esp + 0x3c]
mov esi, eax
mov edi, edx
push dword [esp + 0x3c]
call fcn.00408bd0
add esi, eax
mov dword [0x40da60], esi
adc edi, edx
mov dword [0x40da64], edi
call dword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov esi, eax
mov edi, edx
mov dword [esp + 0x3c], esi
call dword [sym.imp.MSVCP140.dll__Query_perf_counter]
push ebx
push edi
push esi
push edx
push eax
call fcn.00408af0
mov esi, ebx
pop ebx
push 0
push 0x3b9aca00
push esi
push ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], edx
call fcn.00408bd0
push edi
push dword [esp + 0x40]
push edx
push eax
call fcn.00408a40
push 0
push 0x3b9aca00
push dword [esp + 0x3c]
mov edi, eax
mov esi, edx
push dword [esp + 0x3c]
call fcn.00408bd0
add edi, eax
push 0
adc esi, edx
sub edi, dword [0x40da60]
push 0xf4240
sbb esi, dword [0x40da64]
push esi
push edi
call fcn.00408a40
mov edi, eax
mov cl, byte [0x40d8b1]
mov esi, edx
mov al, byte [0x40d8b0]
test al, al
jne 0x401ccd
test cl, cl
je 0x401ccd
test esi, esi
jl 0x401cdb
jg 0x401c99
cmp edi, 0x3a98
jb 0x401ccd
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x114]
call fcn.00405130
lea eax, [esp + 0xe0]
push eax
push dword [esp + 0x114]
lea ecx, [esp + 0x118]
call fcn.00404e40
mov byte [0x40d8b0], al
test esi, esi
jg 0x401cef
jl 0x401cdb
cmp edi, 0x493e0
jae 0x401cef
test al, al
je 0x4018d4
mov esi, dword [esp + 0x7c]
jmp 0x401cf1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
xor esi, esi
mov edx, dword [esp + 0xf4]
cmp edx, 0x10
jb 0x401d2d
mov ecx, dword [esp + 0xe0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401d23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ec3
push edx
push ecx
call fcn.00407a25
add esp, 8
mov edx, dword [esp + 0x10c]
mov dword [esp + 0xf0], 0
mov dword [esp + 0xf4], 0xf
mov byte [esp + 0xe0], 0
cmp edx, 8
jb 0x401d8d
mov ecx, dword [esp + 0xf8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401d83
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ec3
push edx
push ecx
call fcn.00407a25
add esp, 8
mov edx, dword [esp + 0xdc]
xor eax, eax
mov dword [esp + 0x108], 0
mov dword [esp + 0x10c], 7
mov word [esp + 0xf8], ax
cmp edx, 8
jb 0x401def
mov ecx, dword [esp + 0xc8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401de5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ec3
push edx
push ecx
call fcn.00407a25
add esp, 8
mov edx, dword [esp + 0xa4]
xor eax, eax
mov dword [esp + 0xd8], 0
mov dword [esp + 0xdc], 7
mov word [esp + 0xc8], ax
cmp edx, 0x10
jb 0x401e4b
mov ecx, dword [esp + 0x90]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x401e41
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ec3
push edx
push ecx
call fcn.00407a25
add esp, 8
lea ecx, [esp + 0x118]
call fcn.00401f20
mov eax, dword [esp + 0x58]
cmp eax, 8
jb 0x401e8f
mov edx, dword [esp + 0x44]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x401e85
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x401ec3
push ecx
push edx
call fcn.00407a25
add esp, 8
mov edx, dword [esp + 0xc4]
cmp edx, 8
jb 0x401ed3
mov ecx, dword [esp + 0xb0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401ec9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401ec9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407a25
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.00407a14
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [esp + 0x18c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00407a14
mov esp, ebp
pop ebp
ret 0x10