Function at 0x40be07
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x52cf67
mov eax, dword fs:[0]
push eax
sub esp, 0x850
mov eax, dword [0x572480]
xor eax, esp
mov dword [esp + 0x848], eax
push ebx
push esi
push edi
mov eax, dword [0x572480]
xor eax, esp
push eax
lea eax, [esp + 0x860]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.0047bf90
test eax, eax
je 0x40be62
push esi
call fcn.0040b6fa
pop ecx
jmp 0x40cd25
lea eax, [esp + 0x694]
push eax
call fcn.0045ae95
xor ebx, ebx
mov dword [esp + 0x868], ebx
mov eax, dword [esp + 0x694]
lea ecx, [esp + 0x694]
mov dword [esp + 0x698], ebx
call dword [eax]
push esi
test eax, eax
je 0x40be9f
call fcn.0040b6fa
pop ecx
jmp 0x40cd11
call fcn.0040bd52
pop ecx
push 7
pop eax
mov dword [esp + 0x654], eax
mov dword [esp + 0x670], eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x650], ebx
mov word [esp + 0x640], cx
mov dword [esp + 0x66c], ebx
mov word [esp + 0x65c], ax
mov byte [esp + 0x868], 1
mov edi, dword [esp + 0x6cc]
or dword [esp + 0x63c], 0xffffffff
cmp edi, ebx
je 0x40bfd7
push str.DriverVersion
lea eax, [esp + 0x644]
push eax
call fcn.00403fad
push 0x64
pop ecx
mov eax, edi
xor edx, edx
div ecx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x8c]
push eax
mov edi, edx
call fcn.004036d7
mov esi, eax
push dword [esp + 0x24]
mov byte [esp + 0x86c], 2
push esi
call fcn.004053dc
push 0x2e
push esi
call fcn.0040d413
push ebx
lea eax, [esp + 0x40]
push 2
push eax
call fcn.00507867
add esp, 0x14
mov ecx, eax
call fcn.0040d1ab
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push edi
push esi
mov word [eax + esi + 0x40], cx
call fcn.004053dc
lea eax, [esp + 0x678]
push eax
mov eax, esi
call fcn.00403741
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x680]
lea ecx, [esp + 0x664]
mov byte [esp + 0x870], 3
call fcn.00403f13
push 1
xor edi, edi
lea esi, [esp + 0x67c]
mov byte [esp + 0x86c], 2
call fcn.00401501
lea eax, [esp + 0x8c]
mov byte [esp + 0x868], 1
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x63c]
call fcn.0040ce50
push str.HasActiveSLITopology
lea eax, [esp + 0x644]
push eax
call fcn.00403fad
mov eax, dword [esp + 0x6c0]
mov ecx, dword [esp + 0x6bc]
sub eax, ecx
push 0x1c
cdq
pop esi
idiv esi
xor edi, edi
cmp eax, ebx
jbe 0x40c018
add ecx, 0x14
cmp byte [ecx], bl
jne 0x40c0b6
inc edi
add ecx, 0x1c
cmp edi, eax
jb 0x40c008
mov eax, 0x53bd24
push eax
lea eax, [esp + 0x660]
push eax
call fcn.00403fad
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x63c]
call fcn.0040ce50
push str.IsOptimus
lea eax, [esp + 0x644]
push eax
call fcn.00403fad
call fcn.0040ad60
test al, al
mov eax, 0x53bc08
jne 0x40c060
mov eax, 0x53bd24
push eax
lea eax, [esp + 0x660]
push eax
call fcn.00403fad
lea ecx, [esp + 0x63c]
call fcn.0040ce50
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x6b0]
call fcn.0040cdb3
mov byte [esp + 0x868], 4
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
sub eax, edi
sar eax, 2
mov dword [esp + 0x24], ebx
mov dword [esp + 0x44], eax
cmp eax, ebx
jbe 0x40ccda
mov dword [esp + 0x1c], edi
jmp 0x40c0c4
mov eax, 0x53bc08
jmp 0x40c01d
mov edi, dword [esp + 0x1c]
push 7
pop eax
mov dword [esp + 0x5fc], eax
mov dword [esp + 0x618], eax
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x5f8], ebx
mov word [esp + 0x5e8], cx
mov dword [esp + 0x614], ebx
mov word [esp + 0x604], ax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x868], 5
mov dword [esp + 0x5e4], eax
push str.LongGPUName
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
mov eax, dword [edi]
push 0xffffffffffffffff
add eax, 8
push ebx
lea ecx, [esp + 0x60c]
call fcn.00403f13
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
test byte [0x57a904], 1
mov eax, dword [edi]
mov eax, dword [eax + 0x6bc]
mov dword [esp + 0x20], eax
jne 0x40c181
or dword [0x57a904], 1
mov esi, 0x57a8f4
mov byte [esp + 0x868], 6
call fcn.004087b2
push 0x5303c0
call fcn.004e813a
pop ecx
mov byte [esp + 0x868], 5
test byte [0x57a904], 2
jne 0x40c1a6
or dword [0x57a904], 2
mov byte [esp + 0x868], 7
call fcn.00408295
mov byte [esp + 0x868], 5
lea edi, [esp + 0x20]
lea ebx, [esp + 0x48]
mov esi, 0x57a8f4
call fcn.004088a7
push str.DXVersion
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
xor eax, eax
lea ecx, [esp + 0x7e8]
call fcn.0040ad0a
mov ebx, eax
lea eax, [esp + 0x604]
mov byte [esp + 0x868], 0xc
call fcn.00403e2e
push 1
xor edi, edi
lea esi, [esp + 0x7ec]
mov byte [esp + 0x86c], 5
call fcn.00401501
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.CoreCount
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
lea eax, [esp + 0x8c]
push eax
call fcn.004036d7
mov esi, eax
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0x868], 0xd
mov eax, dword [ebx]
push dword [eax + 0xbc]
push esi
call fcn.004053dc
lea eax, [esp + 0x778]
push eax
mov eax, esi
call fcn.00403741
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x780]
lea ecx, [esp + 0x60c]
mov byte [esp + 0x870], 0xe
call fcn.00403f13
push 1
lea esi, [esp + 0x77c]
mov byte [esp + 0x86c], 0xd
call fcn.00401501
lea eax, [esp + 0x8c]
mov byte [esp + 0x868], 5
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.ActualVRAMSize
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
lea eax, [esp + 0x1bc]
push eax
call fcn.004036d7
mov esi, eax
mov byte [esp + 0x868], 0xf
mov eax, dword [ebx]
push dword [eax + 0x9c]
push esi
call fcn.004053dc
lea eax, [esp + 0x7b0]
push eax
mov eax, esi
call fcn.00403741
mov byte [esp + 0x868], 0x10
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x7b8]
lea ecx, [esp + 0x60c]
call fcn.00403f13
push 1
lea esi, [esp + 0x7b4]
mov byte [esp + 0x86c], 0xf
call fcn.00401501
lea eax, [esp + 0x1bc]
mov byte [esp + 0x868], 5
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.GPURAMType
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
mov eax, dword [ebx]
mov eax, dword [eax + 0x610]
lea ecx, [esp + 0x820]
call fcn.0040ac1a
mov ebx, eax
lea eax, [esp + 0x604]
mov byte [esp + 0x868], 0x11
call fcn.00403e2e
push 1
lea esi, [esp + 0x824]
mov byte [esp + 0x86c], 5
call fcn.00401501
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.RAMWidth
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
lea eax, [esp + 0x2ec]
push eax
call fcn.004036d7
mov esi, eax
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0x868], 0x12
mov eax, dword [ebx]
push dword [eax + 0x94]
push esi
call fcn.004053dc
lea eax, [esp + 0x740]
push eax
mov eax, esi
call fcn.00403741
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x748]
lea ecx, [esp + 0x60c]
mov byte [esp + 0x870], 0x13
call fcn.00403f13
push 1
lea esi, [esp + 0x744]
mov byte [esp + 0x86c], 0x12
call fcn.00401501
lea eax, [esp + 0x2ec]
mov byte [esp + 0x868], 5
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.GPUBusType
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
mov eax, dword [ebx]
mov eax, dword [eax + 0x60c]
lea ecx, [esp + 0x804]
call fcn.0040ac9a
mov byte [esp + 0x868], 0x14
mov ebx, eax
lea eax, [esp + 0x604]
call fcn.00403e2e
push 1
lea esi, [esp + 0x808]
mov byte [esp + 0x86c], 5
call fcn.00401501
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.PCIEGeneration
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 0x63c]
lea ecx, [esp + 0x83c]
call fcn.0040acdc
mov ebx, eax
lea eax, [esp + 0x604]
mov byte [esp + 0x868], 0x15
call fcn.00403e2e
push 1
lea esi, [esp + 0x840]
mov byte [esp + 0x86c], 5
call fcn.00401501
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.PCIESpeed
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
lea eax, [esp + 0x41c]
push eax
call fcn.004036d7
mov esi, eax
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0x868], 0x16
mov eax, dword [ebx]
lea ecx, [eax + 0x620]
mov edx, dword [ecx]
add eax, 0x640
cmp edx, dword [eax]
jae 0x40c564
mov eax, ecx
push dword [eax]
push esi
call fcn.004053dc
lea eax, [esp + 0x794]
push eax
mov eax, esi
call fcn.00403741
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x79c]
lea ecx, [esp + 0x60c]
mov byte [esp + 0x870], 0x17
call fcn.00403f13
push 1
xor edi, edi
lea esi, [esp + 0x798]
mov byte [esp + 0x86c], 0x16
call fcn.00401501
lea eax, [esp + 0x41c]
mov byte [esp + 0x868], 5
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.VBIOSVersion
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
mov eax, dword [ebx]
push 0xffffffffffffffff
add eax, 0x78
push edi
lea ecx, [esp + 0x60c]
call fcn.00403f13
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
mov eax, dword [ebx]
mov ecx, dword [eax + 0x170c]
sub ecx, dword [eax + 0x1708]
and dword [esp + 0x14], edi
sar ecx, 2
test ecx, ecx
je 0x40c76e
and dword [esp + 0x630], 0
push 7
pop ecx
xor eax, eax
mov dword [esp + 0x634], ecx
mov word [esp + 0x620], ax
mov esi, dword [esp + 0x14]
mov byte [esp + 0x868], 0x18
mov eax, dword [ebx]
mov eax, dword [eax + 0x1708]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test eax, eax
je 0x40c679
cmp eax, 4
je 0x40c672
cmp eax, ecx
jne 0x40c737
push str.Processor_clock
jmp 0x40c67e
push str.Memory_clock
jmp 0x40c67e
push str.Graphics_clock
lea eax, [esp + 0x624]
push eax
call fcn.00403fad
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x628]
lea ecx, [esp + 0x5f0]
call fcn.00403f13
lea eax, [esp + 0x54c]
push eax
call fcn.004036d7
mov edi, eax
mov byte [esp + 0x868], 0x19
mov eax, dword [ebx]
mov eax, dword [eax + 0x1708]
mov eax, dword [eax + esi*4]
push dword [eax + 4]
push edi
call fcn.004053dc
lea eax, [esp + 0x6ec]
push eax
mov eax, edi
call fcn.00403741
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x6f4]
lea ecx, [esp + 0x60c]
mov byte [esp + 0x870], 0x1a
call fcn.00403f13
push 1
xor edi, edi
lea esi, [esp + 0x6f0]
mov byte [esp + 0x86c], 0x19
call fcn.00401501
lea eax, [esp + 0x54c]
mov byte [esp + 0x868], 0x18
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push 1
xor edi, edi
lea esi, [esp + 0x624]
mov byte [esp + 0x86c], 5
call fcn.00401501
mov eax, dword [ebx]
mov ecx, dword [eax + 0x170c]
sub ecx, dword [eax + 0x1708]
inc dword [esp + 0x14]
sar ecx, 2
cmp dword [esp + 0x14], ecx
jb 0x40c625
push str.IsQuadro
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
mov eax, dword [ebx]
cmp byte [eax + 0xec], 0
mov eax, 0x53bc08
jne 0x40c795
mov eax, 0x53bd24
push eax
lea eax, [esp + 0x608]
push eax
call fcn.00403fad
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
mov ebx, dword [ebx]
mov ax, word [ebx + 0xde]
mov word [esp + 0x28], ax
mov ax, word [ebx + 0xdc]
mov word [esp + 0x2a], ax
mov ax, word [ebx + 0xe2]
mov word [esp + 0x2c], ax
mov ax, word [ebx + 0xe0]
mov word [esp + 0x2e], ax
push str.DeviceId
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
lea eax, [esp + 0x4b4]
push eax
call fcn.004036d7
mov esi, eax
push 0
lea eax, [esp + 0x70]
push 4
push eax
mov byte [esp + 0x874], 0x1b
call fcn.00507867
add esp, 0xc
mov ecx, eax
call fcn.0040d1ab
mov esi, eax
test esi, esi
je 0x40c833
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
mov ebx, 0x800
or ecx, ebx
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push dword [esp + 0x28]
mov word [eax + esi + 0x40], cx
push esi
call fcn.0040d1e6
lea eax, [esp + 0x7cc]
push eax
mov eax, esi
call fcn.00403741
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x7d4]
lea ecx, [esp + 0x60c]
mov byte [esp + 0x870], 0x1c
call fcn.00403f13
push 1
xor edi, edi
lea esi, [esp + 0x7d0]
mov byte [esp + 0x86c], 0x1b
call fcn.00401501
lea eax, [esp + 0x4b4]
mov byte [esp + 0x868], 5
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.VendorId
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
lea eax, [esp + 0x254]
push eax
call fcn.004036d7
mov esi, eax
push edi
lea eax, [esp + 0x80]
push 4
push eax
mov byte [esp + 0x874], 0x1d
call fcn.00507867
add esp, 0xc
mov ecx, eax
call fcn.0040d1ab
mov esi, eax
test esi, esi
je 0x40c917
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, ebx
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push dword [esp + 0x2a]
mov word [eax + esi + 0x40], cx
push esi
call fcn.0040d1e6
lea eax, [esp + 0x708]
push eax
mov eax, esi
call fcn.00403741
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x710]
lea ecx, [esp + 0x60c]
mov byte [esp + 0x870], 0x1e
call fcn.00403f13
push 1
xor edi, edi
lea esi, [esp + 0x70c]
mov byte [esp + 0x86c], 0x1d
call fcn.00401501
lea eax, [esp + 0x254]
mov byte [esp + 0x868], 5
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.SubSystemId
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
lea eax, [esp + 0x124]
push eax
call fcn.004036d7
mov esi, eax
push edi
lea eax, [esp + 0x60]
push 4
push eax
mov byte [esp + 0x874], 0x1f
call fcn.00507867
add esp, 0xc
mov ecx, eax
call fcn.0040d1ab
mov esi, eax
test esi, esi
je 0x40c9f3
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, ebx
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push dword [esp + 0x2c]
mov word [eax + esi + 0x40], cx
push esi
call fcn.0040d1e6
lea eax, [esp + 0x724]
push eax
mov eax, esi
call fcn.00403741
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x72c]
lea ecx, [esp + 0x60c]
mov byte [esp + 0x870], 0x20
call fcn.00403f13
push 1
xor edi, edi
lea esi, [esp + 0x728]
mov byte [esp + 0x86c], 0x1f
call fcn.00401501
lea eax, [esp + 0x124]
mov byte [esp + 0x868], 5
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
push str.SubVendorId
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
lea eax, [esp + 0x384]
push eax
call fcn.004036d7
mov esi, eax
push edi
lea eax, [esp + 0x50]
push 4
push eax
mov byte [esp + 0x874], 0x21
call fcn.00507867
add esp, 0xc
mov ecx, eax
call fcn.0040d1ab
mov esi, eax
test esi, esi
je 0x40cacf
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
mov ecx, dword [eax + 0x14]
and ecx, 0xfffff9ff
or ecx, ebx
mov dword [eax + 0x14], ecx
mov eax, dword [esi]
mov eax, dword [eax + 4]
push 0x30
pop ecx
push dword [esp + 0x2e]
mov word [eax + esi + 0x40], cx
push esi
call fcn.0040d1e6
lea eax, [esp + 0x75c]
push eax
mov eax, esi
call fcn.00403741
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x764]
lea ecx, [esp + 0x60c]
mov byte [esp + 0x870], 0x22
call fcn.00403f13
push 1
xor edi, edi
lea esi, [esp + 0x760]
mov byte [esp + 0x86c], 0x21
call fcn.00401501
lea eax, [esp + 0x384]
mov byte [esp + 0x868], 5
call fcn.004025ae
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
mov eax, dword [esp + 0x6a0]
mov ecx, dword [esp + 0x69c]
and dword [esp + 0x14], edi
sub eax, ecx
sar eax, 2
mov byte [esp + 0x1b], 0
test eax, eax
je 0x40cc6c
mov eax, dword [esp + 0x14]
lea ecx, [ecx + eax*4]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov ecx, dword [ecx]
add eax, 0x40
add ecx, 0xc
call fcn.00406fc7
test al, al
je 0x40cc3f
mov eax, dword [esp + 0x69c]
mov ecx, dword [esp + 0x14]
and dword [esp + 0x20], 0
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
mov ebx, 0xec
mov edx, dword [eax + ebx + 4]
sub edx, dword [eax + ebx]
sar edx, 2
test edx, edx
je 0x40cc3f
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
mov ecx, dword [esp + 0x20]
lea eax, [eax + ecx*4]
mov eax, dword [eax]
add eax, 0x54
push eax
lea esi, [esp + 0x67c]
call fcn.00403165
push 7
push str.Primary
xor eax, eax
mov ecx, esi
mov byte [esp + 0x870], 0x23
call fcn.0040cf1a
xor edi, edi
mov byte [esp + 0x868], 5
push 1
cmp eax, 0xffffffff
jne 0x40cc62
call fcn.00401501
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x69c]
inc dword [esp + 0x20]
lea ecx, [ecx + eax*4]
mov eax, dword [ecx]
mov edx, dword [eax + ebx + 4]
sub edx, dword [eax + ebx]
sar edx, 2
cmp dword [esp + 0x20], edx
jb 0x40cbcc
mov eax, dword [esp + 0x6a0]
mov ecx, dword [esp + 0x69c]
inc dword [esp + 0x14]
sub eax, ecx
sar eax, 2
cmp dword [esp + 0x14], eax
jb 0x40cb82
jmp 0x40cc6c
mov byte [esp + 0x1f], 1
call fcn.00401501
push str.IsPrimary
lea eax, [esp + 0x5ec]
push eax
call fcn.00403fad
cmp byte [esp + 0x1b], 0
mov eax, 0x53bc08
jne 0x40cc8f
mov eax, 0x53bd24
push eax
lea eax, [esp + 0x608]
push eax
call fcn.00403fad
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x5e4]
call fcn.0040ce50
lea ebx, [esp + 0x5e4]
mov byte [esp + 0x868], 4
call fcn.0041df02
inc dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x1c], 4
xor ebx, ebx
cmp eax, dword [esp + 0x44]
jb 0x40c0c0
mov byte [esp + 0x868], 1
cmp dword [esp + 0x34], ebx
je 0x40ccf2
push dword [esp + 0x34]
call fcn.004e7927
pop ecx
mov byte [esp + 0x868], bl
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
lea ebx, [esp + 0x63c]
call fcn.0041df02
or dword [esp + 0x868], 0xffffffff
lea ecx, [esp + 0x694]
call fcn.0045af43
mov ecx, dword [esp + 0x860]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x848]
xor ecx, esp
call fcn.004e72ee
mov esp, ebp
pop ebp
ret