Function at 0x418df0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [ebp + 0x10]
mov ebx, 0x7f2bb747
test eax, eax
je 0x418f3a
push eax
call fcn.00412170
add esp, 4
or edx, eax
je 0x418f3a
push 0xc8
push 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
test eax, eax
je 0x418ea6
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [eax], 0x7f2bb701
mov ecx, ebx
or ecx, 1
mov dword [eax + 8], ecx
mov dword [eax + 0x5c], 0x12
mov word [eax + 0x68], 2
push 0x495d20
mov esi, eax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x418e74
push 0
push 0
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [esi + 0x60], eax
mov eax, ebx
shr eax, 0xd
and eax, 2
shr ebx, 0x11
and ebx, 4
add eax, ebx
add eax, 0x8001
lea ecx, [esi + 4]
push ecx
push eax
push edi
mov eax, dword [ebp + 0x14]
call dword [eax + 8]
add esp, 0xc
test eax, eax
mov dword [esp + 4], esi
je 0x418eb0
mov ebx, eax
xor edi, edi
jmp 0x418f25
mov ebx, 0x7f2bb746
jmp 0x418f3a
mov eax, dword [esi + 4]
mov dword [esi + 0x88], eax
mov dword [eax + 0x5c], esi
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 1
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x418f1e
mov dword [esi + 0xc], eax
push edi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
push 0x400
push 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
test eax, eax
je 0x418f1e
mov edi, eax
mov dword [esi + 0x10], eax
mov dword [eax + 0x38], 0x1ef53
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x64]
mov dword [edi + 0x18], eax
mov dword [esp + 0x2c], ecx
test ecx, 0x200
jne 0x418f44
mov dword [edi + 0x1c], eax
jmp 0x418f61
xor edi, edi
mov ebx, 0x7f2bb746
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
push dword [esp + 4]
call fcn.00431300
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [esi + 0x1c]
lea edx, [eax + 4]
test ecx, ecx
cmovne edx, ecx
mov dword [edi + 0x1c], edx
mov ebx, 0x7f2bb747
cmp eax, edx
mov eax, edx
ja 0x418ea2
mov ecx, dword [esi + 0x14]
xor edx, edx
test eax, eax
sete dl
test ecx, ecx
cmovne edx, ecx
mov dword [edi + 0x14], edx
movzx eax, word [esi + 0x36]
mov word [edi + 0x36], ax
mov eax, dword [esi + 0x3c]
test ax, ax
mov ecx, 1
cmovne ecx, eax
mov word [edi + 0x3c], cx
mov eax, dword [esi + 0x5c]
mov dword [edi + 0x5c], eax
mov eax, dword [esi + 0x60]
mov dword [edi + 0x60], eax
mov ecx, dword [esp + 0x2c]
mov dword [edi + 0x64], ecx
mov ecx, dword [esi + 0x100]
mov dword [edi + 0x100], ecx
mov ecx, dword [esi + 0x104]
mov dword [edi + 0x104], ecx
movzx ecx, word [esi + 0x164]
mov word [edi + 0x164], cx
mov ecx, dword [esi + 0x170]
mov dword [edi + 0x170], ecx
mov cl, byte [esi + 0x174]
mov byte [edi + 0x174], cl
mov ecx, dword [esi + 0x160]
mov dword [edi + 0x160], ecx
mov ecx, dword [esi + 0x24c]
mov dword [edi + 0x24c], ecx
mov ecx, dword [esi + 0x250]
mov dword [edi + 0x250], ecx
movzx ecx, word [esi + 0x27c]
mov word [edi + 0x27c], cx
movzx edx, word [esi + 0x27e]
mov word [edi + 0x27e], dx
test eax, 0x20000
je 0x41903b
push ecx
call fcn.00434bd0
add esp, 4
mov ecx, dword [esp + 4]
mov dword [ecx + 0xc4], eax
mov eax, dword [edi + 0x60]
mov ebx, 0x7f2bb743
test eax, 0xfffc1921
jne 0x418ea2
mov ebx, 0x7f2bb744
test dword [edi + 0x64], 0xffff0884
jne 0x418ea2
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
test eax, eax
je 0x4190c1
mov eax, dword [esi + 0x54]
test eax, eax
mov ecx, 0xb
cmovne ecx, eax
mov dword [edi + 0x54], ecx
mov eax, dword [esi + 0x58]
test ax, ax
mov ecx, 0x80
cmovne ecx, eax
mov word [edi + 0x58], cx
movzx eax, cx
cmp eax, 0xa0
jb 0x4190ce
mov eax, dword [esi + 0x15c]
test ax, ax
mov ecx, 0x20
cmove eax, ecx
mov word [edi + 0x15c], ax
movzx eax, word [esi + 0x15e]
test ax, ax
cmove eax, ecx
mov word [edi + 0x15e], ax
jmp 0x4190ce
mov dword [edi + 0x54], 0xb
mov word [edi + 0x58], 0x80
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov ebx, dword [esp + 4]
mov eax, dword [ebx + 0x60]
test eax, eax
jne 0x4190ea
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time32]
add esp, 4
mov dword [edi + 0x40], eax
mov dword [edi + 0x108], eax
mov dword [edi + 0x48], 0
mov edx, dword [edi + 0x18]
mov esi, 0x400
mov ecx, edx
shl esi, cl
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], esi
mov ecx, dword [edi + 0x1c]
mov eax, ecx
sub eax, edx
mov dword [ebx + 0x64], eax
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebx + 0x20]
test dword [esp + 0x2c], 0x200
mov dword [esp + 8], edi
jne 0x419159
lea ebx, [esi*8]
test edx, edx
cmovne ebx, edx
mov eax, 0x400
shl eax, cl
cdq
idiv esi
imul eax, eax, 0xfff8
cmp ebx, eax
cmova ebx, eax
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
mov esi, dword [ebp + 0x10]
jmp 0x4191e6
mov edi, dword [ebx + 0x24]
test edx, edx
je 0x419182
mov esi, edi
mov ecx, eax
shl esi, cl
test edi, edi
je 0x419177
mov ebx, 0x7f2bb747
cmp esi, edx
jne 0x418ea2
mov ecx, eax
shr edx, cl
test edi, edi
cmove edi, edx
jmp 0x41919f
test edi, edi
jne 0x41919f
add ecx, 0xf
lea edi, [esi*8]
cmp ecx, 0x20
lea ecx, [esi*8 - 8]
cmovb ecx, edi
mov edi, ecx
mov edx, dword [esp + 8]
mov dword [edx + 0x24], edi
cmp edi, 0xfff9
jb 0x4191ba
mov dword [edx + 0x24], 0xfff8
mov edi, 0xfff8
xor edx, edx
mov ecx, eax
shld edx, edi, cl
shl edi, cl
mov ecx, edi
xor edi, edi
test al, 0x20
cmovne edx, ecx
cmovne ecx, edi
mov ebx, 0x7f2bb747
test edx, edx
mov esi, dword [ebp + 0x10]
jne 0x418f25
mov edi, dword [esp + 8]
mov dword [edi + 0x20], ecx
push esi
call fcn.00412170
add esp, 4
mov ecx, dword [esp + 4]
mov cl, byte [ecx + 0x64]
mov ebx, esi
mov esi, 0xffffffff
shl esi, cl
and eax, esi
sar esi, 0x1f
and esi, edx
push esi
push eax
push edi
call fcn.004122b0
add esp, 0xc
push ebx
call fcn.00412300
add esp, 4
push edx
push eax
push edi
call fcn.00412330
add esp, 0xc
push edi
call fcn.00412300
add esp, 4
mov dword [esp + 0x10], eax
mov esi, edi
mov edi, edx
push ebx
call fcn.00412170
add esp, 4
mov ebx, 0x7f2bb747
cmp dword [esp + 0x10], eax
sbb edi, edx
jae 0x418ea2
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
movzx eax, word [eax + 0x166]
mov word [esi + 0x166], ax
test byte [esi + 0x60], 8
je 0x4192cb
mov eax, dword [esp + 4]
mov dword [eax + 0x1c], 0
or byte [eax + 8], 6
mov dword [ecx], eax
xor ebx, ebx
jmp 0x418f3a
subsd xmm0, xmm1
movsd qword [esp + 0x40], xmm0
setae al
fld qword [esp + 0x40]
fnstcw word [esp + 0x32]
movzx ecx, word [esp + 0x32]
or ecx, 0xc00
mov word [esp + 0x3a], cx
fldcw word [esp + 0x3a]
fistp qword [esp + 0x40]
fldcw word [esp + 0x32]
movzx eax, al
shl eax, 0x1f
xor eax, dword [esp + 0x44]
push eax
push dword [esp + 0x44]
push esi
call fcn.00412330
add esp, 0xc
push esi
call fcn.00412170
add esp, 4
sub eax, dword [esi + 0x14]
sbb edx, 0
mov ecx, eax
or ecx, edx
je 0x419811
add eax, 0xffffffff
adc edx, 0xffffffff
push 0
push dword [esi + 0x20]
push edx
push eax
call fcn.004242b0
add esp, 0x10
mov ecx, esi
mov edi, eax
mov ebx, 0x7f2bb72c
inc eax
mov esi, dword [esp + 4]
mov dword [esi + 0x1c], eax
je 0x418ea2
mov eax, dword [ebp + 0x10]
movzx eax, word [eax + 0xfe]
mov edx, dword [ecx + 0x60]
mov dword [esp + 0x10], edx
shr edx, 1
and edx, 0x40
test ax, ax
cmovne edx, eax
mov word [ecx + 0xfe], dx
mov cl, byte [ecx + 0x18]
mov eax, 0x400
shl eax, cl
test byte [esp + 0x10], 0x80
movzx ecx, dx
mov edx, 0x20
cmove ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, edi
xor edx, edx
div ecx
add eax, 1
mov dword [esi + 0x20], eax
mov ecx, dword [esi + 0x14]
mov esi, 1
cmp ecx, 0xfff
ja 0x41937a
mov ax, 0x1000
xor edx, edx
div cx
movzx esi, ax
test byte [esp + 0x10], 0x80
mov edi, dword [esp + 8]
je 0x4193b2
push edi
call fcn.00412170
add esp, 4
push 0
push esi
push edx
push eax
call fcn.004242b0
add esp, 0x10
test edx, edx
je 0x4193b2
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
cmp ecx, 1
mov eax, 0
sbb eax, eax
or eax, ecx
jmp 0x4193d1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x4193d1
push edi
call fcn.00412170
add esp, 4
push 0
push esi
push edx
push eax
call fcn.004242b0
add esp, 0x10
mov dword [edi], eax
mov ecx, dword [edi + 0x4c]
mov dword [esp + 0x34], ecx
test ecx, ecx
je 0x419401
mov ecx, dword [edi + 0x54]
lea edx, [ecx + 1]
cmp eax, edx
jb 0x41940b
test eax, eax
jne 0x419412
mov ecx, dword [edi + 0x18]
mov edx, 0x400
mov dword [esp + 0xc], ecx
shl edx, cl
xor edi, edi
jmp 0x4194db
mov ecx, 0xb
cmp eax, 0xc
jae 0x419412
add ecx, 1
mov dword [edi], ecx
mov eax, ecx
add eax, 0xffffffff
xor edx, edx
mov ecx, dword [esp + 4]
div dword [ecx + 0x1c]
mov edi, eax
mov eax, dword [ecx + 0x14]
shl eax, 3
cmp edi, eax
jae 0x41945c
lea eax, [edi + 1]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 8]
mov ecx, dword [edx + 0x18]
mov eax, 0x400
mov dword [esp + 0xc], ecx
shl eax, cl
cmp dword [esp + 0x34], 0
je 0x4194a8
movzx esi, word [edx + 0x58]
mov ecx, eax
cdq
idiv esi
mov edx, 0x10000
sub edx, eax
jmp 0x4194c1
mov ebx, 0x7f2bb75b
test dword [esp + 0x2c], 0x200
jne 0x418ea2
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp eax, 0x100
jb 0x418ea2
add eax, 0xfffffff8
mov dword [esi + 0x20], eax
push dword [ebp + 0x10]
call fcn.00412170
add esp, 4
push edx
push eax
push esi
call fcn.004122b0
add esp, 0xc
mov eax, dword [esi + 0x20]
mov dword [esi + 0x24], eax
jmp 0x4192cb
lea esi, [eax + 0x7f]
test eax, eax
cmovns esi, eax
sar esi, 7
mov ecx, eax
mov edx, 0x10000
sub edx, esi
mov esi, 0x80
cmp edi, edx
jae 0x4194cd
mov edx, ecx
mov edi, dword [esp + 0x10]
jmp 0x4194db
mov eax, ecx
cdq
idiv esi
mov edi, 0x10000
sub edi, eax
mov edx, ecx
add dword [esp + 0xc], 0xa
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x3c], eax
mov esi, edi
mov eax, edi
shl eax, 7
add eax, edx
add eax, 0xffffffff
mov dword [esp + 0x10], eax
mov dword [esp + 0x48], edx
jmp 0x41951e
mov eax, dword [esp + 0x10]
and edi, 0xfffffff8
add esi, 0xffffffff
add eax, 0xffffff80
mov dword [esp + 0x10], eax
mov eax, edi
mul dword [esp + 0x3c]
mov edx, dword [esp + 0x48]
jno 0x41957a
cmp dword [esp + 0x34], 0
je 0x419554
mov eax, dword [esp + 8]
movzx edi, word [eax + 0x58]
mov eax, esi
imul eax, edi
add eax, edx
add eax, 0xffffffff
mov ecx, dword [esp + 0xc]
shr eax, cl
imul eax, edx
xor edx, edx
mov ecx, edi
div edi
mov edi, eax
cmp eax, 9
jae 0x419501
mov edi, 8
jmp 0x419501
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
shr edi, cl
imul edi, edx
shr edi, 7
cmp edi, 9
mov eax, 8
cmovb edi, eax
mov eax, dword [esp + 0x10]
mov ecx, 0x80
jmp 0x419505
imul ecx, edi
lea eax, [ecx + edx]
add eax, 0xffffffff
mov ecx, dword [esp + 0xc]
shr eax, cl
mov ecx, dword [esp + 4]
mov dword [ecx + 0x28], eax
mov esi, dword [esp + 8]
mov dword [esi + 0x28], edi
mov eax, dword [esp + 0x3c]
imul eax, edi
mov dword [esi], eax
mov dword [esi + 0x10], eax
xor edi, edi
test byte [esi + 0x5c], 0x10
mov eax, 0
je 0x4195c3
mov ecx, dword [esp + 4]
call fcn.00419b10
mov cl, byte [esi + 0x18]
mov edx, 0x400
shl edx, cl
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + 0xce]
test ecx, ecx
cmovne eax, ecx
mov word [esi + 0xce], ax
movzx ecx, ax
shr edx, 2
cmp ecx, edx
ja 0x419826
mov edx, dword [esp + 4]
add ecx, dword [edx + 0x20]
mov edx, dword [esi + 0x20]
lea edx, [edx + edx*2]
shr edx, 2
cmp ecx, edx
mov edx, dword [esp + 4]
jbe 0x419622
mov eax, dword [edx + 0x10]
or dword [eax + 0x60], 0x10
mov eax, dword [edx + 0x10]
and dword [eax + 0x5c], 0xffffffef
mov eax, dword [ebp + 0x10]
movzx eax, word [eax + 0xce]
mov ecx, dword [esp + 8]
mov word [ecx + 0xce], ax
mov ecx, dword [edx + 0x10]
mov esi, dword [edx + 0x28]
movzx eax, ax
mov dword [esp + 0x10], esi
add eax, esi
add eax, 3
test byte [ecx + 0x60], 0x10
jne 0x41963f
add eax, dword [edx + 0x20]
jmp 0x419642
add eax, 1
mov ecx, edx
mov edx, dword [esp + 8]
cmp eax, dword [edx + 0x20]
ja 0x419830
test byte [edx + 0x5d], 2
mov eax, dword [ecx + 0x1c]
jne 0x419669
add eax, 0xffffffff
push eax
push ecx
call fcn.004141b0
add esp, 8
jmp 0x41968b
cmp eax, 2
jne 0x41967c
xor eax, eax
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x24c], 0
jmp 0x419688
xor eax, eax
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x250], 0
setne al
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x4196b0
add ecx, 3
mov esi, dword [esp + 8]
movzx eax, word [esi + 0xce]
mov edx, dword [esp + 4]
add ecx, dword [edx + 0x20]
add ecx, eax
mov dword [esp + 0x10], ecx
jmp 0x4196bb
add ecx, 2
mov dword [esp + 0x10], ecx
mov esi, dword [esp + 8]
push esi
call fcn.00412170
add esp, 4
sub eax, dword [esi + 0x14]
sbb edx, 0
push 0
push dword [esi + 0x20]
push edx
push eax
call fcn.004243c0
add esp, 0x10
mov ecx, dword [esp + 4]
mov esi, dword [ecx + 0x1c]
cmp esi, 1
mov ecx, dword [esp + 0x10]
jne 0x4196f5
test eax, eax
je 0x4196f5
cmp ecx, eax
ja 0x418f25
test eax, eax
je 0x41983a
add ecx, 0x32
cmp ecx, eax
jbe 0x41983a
mov ebx, edx
mov edi, eax
mov esi, dword [esp + 8]
push esi
call fcn.00412170
add esp, 4
sub eax, edi
sbb edx, ebx
push edx
push eax
push esi
call fcn.004122b0
add esp, 0xc
mov edi, dword [ebp + 0x10]
push edi
call fcn.00412300
add esp, 4
movd xmm0, edx
movd xmm1, eax
punpckldq xmm1, xmm0
movdqa xmm0, xmmword [0x495cf0]
punpckldq xmm1, xmm0
movapd xmm0, xmmword [0x495d00]
subpd xmm1, xmm0
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
movsd xmm0, qword [0x495d10]
mulsd xmm2, xmm0
movapd xmmword [esp + 0x10], xmm2
push edi
call fcn.00412170
add esp, 4
movd xmm0, edx
movd xmm1, eax
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x495cf0]
subpd xmm1, xmmword [0x495d00]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
movapd xmm1, xmmword [esp + 0x10]
divsd xmm1, xmm0
movapd xmmword [esp + 0x10], xmm1
push esi
call fcn.00412170
add esp, 4
movd xmm0, edx
movd xmm1, eax
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x495cf0]
subpd xmm1, xmmword [0x495d00]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mulsd xmm0, qword [esp + 0x10]
divsd xmm0, qword [0x495d10]
movsd xmm1, qword [0x495d18]
ucomisd xmm0, xmm1
jae 0x419282
xorpd xmm1, xmm1
jmp 0x419282
mov eax, dword [esp + 4]
mov dword [eax + 0x1c], 0
mov ebx, 0x7f2bb72c
jmp 0x418ea2
mov ebx, 0x7f2bb75d
jmp 0x418f25
mov ebx, 0x7f2bb75b
jmp 0x418f25
mov ecx, dword [esp + 8]
test byte [ecx + 0x5d], 2
je 0x41989c
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + 0x24c]
cmp ecx, esi
jb 0x41985f
lea ecx, [esi - 1]
mov edx, dword [esp + 8]
mov dword [edx + 0x24c], ecx
mov edx, dword [esp + 8]
mov eax, dword [edx + 0x250]
lea ebx, [esi - 1]
cmp eax, esi
cmovb ebx, eax
xor edx, edx
cmp ecx, ebx
cmovne edx, ebx
je 0x41987e
cmp eax, esi
jb 0x419888
mov eax, dword [esp + 8]
mov dword [eax + 0x250], edx
cmp ecx, edx
jbe 0x41989c
mov eax, dword [esp + 8]
mov dword [eax + 0x24c], edx
mov dword [eax + 0x250], ecx
mov eax, dword [esp + 4]
mov esi, dword [eax + 0xc]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 0x50
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x418f20
movupd xmm0, xmmword [0x495d34]
mov ebx, dword [esp + 0x10]
movupd xmmword [ebx], xmm0
mov word [ebx + 0x10], 0x20
push esi
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 8
mov ecx, dword [esp + 4]
lea eax, [ecx + 0x30]
push eax
push ebx
push ecx
call fcn.0042f7f0
add esp, 0xc
test eax, eax
jne 0x419934
movupd xmm0, xmmword [0x495d46]
mov ebx, dword [esp + 0x10]
movupd xmmword [ebx], xmm0
mov word [ebx + 0x10], 0x20
mov esi, dword [esp + 4]
push dword [esi + 0xc]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 8
mov eax, esi
add eax, 0x2c
push eax
push ebx
push esi
call fcn.0042f6b0
add esp, 0xc
test eax, eax
je 0x41993f
mov ebx, eax
mov edi, dword [esp + 0x10]
jmp 0x418f25
push dword [esp + 0x10]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, dword [esp + 4]
mov esi, dword [eax + 0x14]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x419963
mov eax, ecx
mul esi
jo 0x418f20
imul esi, ecx
push esi
push 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
mov ebx, 0x7f2bb746
test eax, eax
je 0x418f25
mov ecx, dword [esp + 4]
mov dword [ecx + 0x24], eax
mov eax, dword [ecx + 0x1c]
xor ebx, ebx
test eax, eax
je 0x419aa4
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x64]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
xor esi, esi
jmp 0x419a0b
add dword [esp + 0x2c], eax
adc dword [esp + 0xc], 0
push eax
push esi
mov edi, dword [esp + 0xc]
push edi
call fcn.00412700
add esp, 0xc
mov eax, dword [edi + 0x10]
push dword [eax + 0x28]
push esi
push edi
call fcn.00412780
add esp, 0xc
push 0
push esi
push edi
call fcn.004127f0
add esp, 0xc
push esi
push edi
call fcn.00413f90
add esp, 8
add esi, 1
mov eax, dword [edi + 0x1c]
cmp esi, eax
jae 0x419ab4
test dword [esp + 0x34], 0x410
je 0x419a72
add eax, 0xffffffff
cmp esi, eax
je 0x419a2b
push 2
push esi
push dword [esp + 0xc]
call fcn.00412920
add esp, 0xc
push 1
push esi
push dword [esp + 0xc]
call fcn.00412920
add esp, 0xc
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x28]
xor edi, edi
cmp dword [esp + 0x10], 0
je 0x419a5e
mov eax, ecx
sub eax, dword [esp + 0x10]
ja 0x419a60
mov edx, dword [esp + 0x10]
sub edx, ecx
xor eax, eax
mov edi, edx
jmp 0x419a60
mov eax, ecx
push eax
push esi
push dword [esp + 0xc]
call fcn.00412870
add esp, 0xc
mov dword [esp + 0x10], edi
mov edi, dword [esp + 4]
push dword [edi + 0x30]
push esi
push edi
call fcn.00435350
add esp, 0xc
mov ecx, dword [edi + 0x10]
cmp byte [ecx + 0x174], 0
je 0x4199bf
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 0x28]
add eax, ecx
add eax, 2
jmp 0x4199bf
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0
mov esi, dword [esp + 4]
mov cl, byte [esi + 0x64]
mov eax, 0xffffffff
shl eax, cl
mov ecx, dword [esp + 0x2c]
and ecx, eax
sar eax, 0x1f
and eax, dword [esp + 0xc]
push eax
push ecx
mov edi, dword [esp + 0x10]
push edi
call fcn.004123b0
add esp, 0xc
or byte [edi + 0x160], 1
or byte [esi + 8], 0x36
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push dword [esi + 0x14]
push eax
call dword [ecx + 0x10]
add esp, 8
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
jmp 0x418f3a