Function at 0x4182f0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov eax, dword [ebp + 0x10]
mov ebx, 0x7f2bb747
test eax, eax
je 0x418438
push eax
call fcn.00411820
add esp, 4
or edx, eax
je 0x418438
push 0xc8
push 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
test eax, eax
je 0x4183a6
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [eax], 0x7f2bb701
mov ecx, ebx
or ecx, 1
mov dword [eax + 8], ecx
mov dword [eax + 0x5c], 0x12
mov word [eax + 0x68], 2
push 0x492df0
mov edi, eax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x418374
push 0
push 0
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [edi + 0x60], eax
mov eax, ebx
shr eax, 0xd
and eax, 2
shr ebx, 0x11
and ebx, 4
add eax, ebx
add eax, 0x8001
lea ecx, [edi + 4]
push ecx
push eax
push esi
mov eax, dword [ebp + 0x14]
call dword [eax + 8]
add esp, 0xc
test eax, eax
mov dword [esp + 4], edi
je 0x4183b0
mov ebx, eax
xor edi, edi
jmp 0x418423
mov ebx, 0x7f2bb746
jmp 0x418438
mov eax, dword [edi + 4]
mov dword [edi + 0x88], eax
mov dword [eax + 0x5c], edi
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
inc eax
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x41841c
mov dword [edi + 0xc], eax
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
push 0x400
push 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
test eax, eax
je 0x41841c
mov esi, eax
mov dword [edi + 0x10], eax
mov dword [eax + 0x38], 0x1ef53
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x64]
mov dword [esi + 0x18], eax
mov dword [esp + 0x28], ecx
test ecx, 0x200
jne 0x418442
mov dword [esi + 0x1c], eax
jmp 0x41845f
xor edi, edi
mov ebx, 0x7f2bb746
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
push dword [esp + 4]
call fcn.0042eb20
add esp, 4
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov ecx, dword [edi + 0x1c]
lea edx, [eax + 4]
test ecx, ecx
cmovne edx, ecx
mov dword [esi + 0x1c], edx
mov ebx, 0x7f2bb747
cmp eax, edx
mov eax, edx
ja 0x4183a2
xor ecx, ecx
test eax, eax
mov eax, dword [edi + 0x14]
sete cl
test eax, eax
cmovne ecx, eax
mov dword [esi + 0x14], ecx
movzx eax, word [edi + 0x36]
mov word [esi + 0x36], ax
mov eax, dword [edi + 0x3c]
test ax, ax
mov ecx, 1
cmovne ecx, eax
mov word [esi + 0x3c], cx
mov eax, dword [edi + 0x5c]
mov dword [esi + 0x5c], eax
mov eax, dword [edi + 0x60]
mov dword [esi + 0x60], eax
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x64], ecx
movsd xmm0, qword [edi + 0x100]
movsd qword [esi + 0x100], xmm0
movzx ecx, word [edi + 0x164]
mov word [esi + 0x164], cx
mov ecx, dword [edi + 0x170]
mov dword [esi + 0x170], ecx
movzx ecx, byte [edi + 0x174]
mov byte [esi + 0x174], cl
mov ecx, dword [edi + 0x160]
mov dword [esi + 0x160], ecx
movq xmm0, qword [edi + 0x24c]
movq qword [esi + 0x24c], xmm0
mov ecx, dword [edi + 0x27c]
mov dword [esi + 0x27c], ecx
test eax, 0x20000
je 0x418523
movd xmm0, ecx
pextrw eax, xmm0, 0
push eax
call fcn.00432110
add esp, 4
mov ecx, dword [esp + 4]
mov dword [ecx + 0xc4], eax
mov eax, dword [esi + 0x60]
mov ebx, 0x7f2bb743
test eax, 0xfffc1921
jne 0x4183a2
mov ebx, 0x7f2bb744
test dword [esi + 0x64], 0xffff0884
jne 0x4183a2
mov eax, dword [edi + 0x4c]
mov dword [esi + 0x4c], eax
test eax, eax
je 0x4185a9
mov eax, dword [edi + 0x54]
test eax, eax
mov ecx, 0xb
cmovne ecx, eax
mov dword [esi + 0x54], ecx
mov eax, dword [edi + 0x58]
test ax, ax
mov ecx, 0x80
cmovne ecx, eax
mov word [esi + 0x58], cx
movzx eax, cx
cmp eax, 0xa0
jb 0x4185b6
movd xmm0, dword [edi + 0x15c]
pxor xmm1, xmm1
pcmpeqw xmm1, xmm0
movdqa xmm2, xmm1
pandn xmm2, xmm0
pand xmm1, xmmword [0x492db0]
por xmm1, xmm2
movd dword [esi + 0x15c], xmm1
jmp 0x4185b6
mov dword [esi + 0x54], 0xb
mov word [esi + 0x58], 0x80
mov eax, dword [edi + 0x44]
mov dword [esi + 0x44], eax
mov ebx, esi
mov esi, dword [esp + 4]
mov eax, dword [esi + 0x60]
test eax, eax
jne 0x4185d4
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time32]
add esp, 4
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x108], eax
mov dword [ebx + 0x48], 0
mov ecx, dword [ebx + 0x18]
mov edi, 0x400
shl edi, cl
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov eax, dword [ebx + 0x1c]
mov edx, eax
sub edx, ecx
mov dword [esp + 0x10], edx
mov dword [esi + 0x64], edx
mov edx, dword [ebp + 0x10]
mov esi, dword [edx + 0x20]
test dword [esp + 0x28], 0x200
mov dword [esp + 8], ebx
jne 0x418648
mov ebx, 0x2000
shl ebx, cl
test esi, esi
cmovne ebx, esi
mov ecx, eax
mov eax, 0x400
shl eax, cl
cdq
idiv edi
imul eax, eax, 0xfff8
cmp ebx, eax
cmovae ebx, eax
mov edi, dword [esp + 8]
mov dword [edi + 0x20], ebx
mov dword [edi + 0x24], ebx
jmp 0x4186d4
mov edi, edx
mov edx, eax
mov eax, dword [edi + 0x24]
test esi, esi
je 0x418679
mov edi, eax
mov ecx, dword [esp + 0x10]
shl edi, cl
test eax, eax
je 0x41866c
mov ebx, 0x7f2bb747
cmp edi, esi
jne 0x4183a2
mov ecx, dword [esp + 0x10]
shr esi, cl
test eax, eax
cmove eax, esi
jmp 0x418690
test eax, eax
jne 0x418690
add edx, 0xf
mov esi, 0x2000
shl esi, cl
lea eax, [esi - 8]
cmp edx, 0x20
cmovb eax, esi
mov ecx, dword [esp + 8]
mov dword [ecx + 0x24], eax
cmp eax, 0xfff9
jb 0x4186aa
mov dword [ecx + 0x24], 0xfff8
mov eax, 0xfff8
xor esi, esi
mov ecx, dword [esp + 0x10]
shld esi, eax, cl
shl eax, cl
xor edi, edi
test cl, 0x20
cmovne esi, eax
cmovne eax, edi
mov ebx, 0x7f2bb747
test esi, esi
jne 0x418423
mov edi, dword [esp + 8]
mov dword [edi + 0x20], eax
mov ebx, dword [ebp + 0x10]
push ebx
call fcn.00411820
add esp, 4
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + 0x64]
mov esi, 0xffffffff
shl esi, cl
and eax, esi
sar esi, 0x1f
and esi, edx
push esi
push eax
push edi
call fcn.00411960
add esp, 0xc
push ebx
call fcn.004119b0
add esp, 4
push edx
push eax
push edi
call fcn.004119e0
add esp, 0xc
push edi
call fcn.004119b0
add esp, 4
mov dword [esp + 0x10], eax
mov esi, edi
mov edi, edx
push ebx
call fcn.00411820
add esp, 4
mov ebx, 0x7f2bb747
cmp dword [esp + 0x10], eax
sbb edi, edx
jae 0x4183a2
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
movzx eax, word [eax + 0x166]
mov word [esi + 0x166], ax
test byte [esi + 0x60], 8
jne 0x418785
push esi
call fcn.00411820
add esp, 4
mov ecx, dword [esi + 0x14]
mov ebx, esi
mov esi, eax
xor esi, ecx
or esi, edx
jne 0x41879d
mov eax, dword [esp + 4]
mov dword [eax + 0x1c], 0
mov ebx, 0x7f2bb72c
jmp 0x4183a2
mov eax, dword [esp + 4]
mov dword [eax + 0x1c], 0
or byte [eax + 8], 6
mov dword [ecx], eax
xor ebx, ebx
jmp 0x418438
xor edi, edi
jmp 0x418808
subsd xmm0, xmm1
movsd qword [esp + 0x40], xmm0
setae al
fld qword [esp + 0x40]
fnstcw word [esp + 0x2e]
movzx ecx, word [esp + 0x2e]
or ecx, 0xc00
mov word [esp + 0x3a], cx
fldcw word [esp + 0x3a]
fistp qword [esp + 0x40]
fldcw word [esp + 0x2e]
movzx eax, al
shl eax, 0x1f
xor eax, dword [esp + 0x44]
push eax
push dword [esp + 0x44]
push esi
call fcn.004119e0
add esp, 0xc
mov edi, dword [esp + 0x30]
push esi
call fcn.00411820
add esp, 4
mov ecx, dword [esi + 0x14]
mov ebx, esi
mov esi, eax
xor esi, ecx
or esi, edx
je 0x418770
mov esi, edi
not esi
not ecx
add ecx, eax
adc esi, edx
push 0
push dword [ebx + 0x20]
push esi
push ecx
call fcn.004236c0
add esp, 0x10
mov edx, edi
mov edi, eax
mov ecx, ebx
mov ebx, 0x7f2bb72c
inc eax
mov esi, dword [esp + 4]
mov dword [esi + 0x1c], eax
je 0x418d2d
mov eax, dword [ebp + 0x10]
movzx eax, word [eax + 0xfe]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0x60]
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], edx
mov edx, eax
shr edx, 1
and edx, 0x40
mov eax, dword [esp + 0xc]
test ax, ax
cmovne edx, eax
mov word [ecx + 0xfe], dx
movzx ecx, byte [ecx + 0x18]
mov eax, 0x400
shl eax, cl
test byte [esp + 0x10], 0x80
movzx ecx, dx
mov edx, 0x20
cmove ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, edi
mov edi, dword [esp + 0x30]
mov edx, edi
div ecx
inc eax
mov dword [esi + 0x20], eax
mov ecx, dword [esi + 0x14]
mov esi, 1
cmp ecx, 0xfff
ja 0x4188b5
mov ax, 0x1000
mov edx, edi
div cx
movzx esi, ax
test byte [esp + 0x10], 0x80
je 0x4188e9
push dword [esp + 8]
call fcn.00411820
add esp, 4
push 0
push esi
push edx
push eax
call fcn.004236c0
add esp, 0x10
test edx, edx
je 0x4188e9
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
cmp ecx, 1
mov eax, edi
sbb eax, edi
or eax, ecx
jmp 0x41890b
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x41890b
push dword [esp + 8]
call fcn.00411820
add esp, 4
push 0
push esi
push edx
push eax
call fcn.004236c0
add esp, 0x10
mov esi, dword [esp + 8]
mov dword [esi], eax
mov ecx, dword [esi + 0x4c]
mov dword [esp + 0x34], ecx
test ecx, ecx
je 0x41893f
mov ecx, dword [esi + 0x54]
lea edx, [ecx + 1]
cmp eax, edx
jb 0x418949
test eax, eax
jne 0x41894e
mov ecx, dword [esi + 0x18]
mov edx, 0x400
mov dword [esp + 0xc], ecx
shl edx, cl
xor edi, edi
jmp 0x418a12
mov ecx, 0xb
cmp eax, 0xc
jae 0x41894e
inc ecx
mov dword [esi], ecx
mov eax, ecx
dec eax
xor edx, edx
mov ecx, dword [esp + 4]
div dword [ecx + 0x1c]
mov edi, eax
mov eax, dword [ecx + 0x14]
shl eax, 3
cmp edi, eax
jae 0x418992
lea eax, [edi + 1]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 0x18]
mov eax, 0x400
mov dword [esp + 0xc], ecx
shl eax, cl
cmp dword [esp + 0x34], 0
je 0x4189df
movzx esi, word [esi + 0x58]
mov ecx, eax
cdq
idiv esi
mov edx, 0x10000
sub edx, eax
jmp 0x4189f8
mov ebx, 0x7f2bb75b
test dword [esp + 0x28], 0x200
jne 0x418e4d
mov eax, dword [esi + 0x20]
cmp eax, 0x100
mov ecx, dword [ebp + 0x10]
mov edi, dword [esp + 0x30]
jb 0x418423
add eax, 0xfffffff8
mov dword [esi + 0x20], eax
push ecx
call fcn.00411820
add esp, 4
push edx
push eax
push esi
call fcn.00411960
add esp, 0xc
mov eax, dword [esi + 0x20]
mov dword [esi + 0x24], eax
jmp 0x4187ee
lea esi, [eax + 0x7f]
test eax, eax
cmovns esi, eax
sar esi, 7
mov ecx, eax
mov edx, 0x10000
sub edx, esi
mov esi, 0x80
cmp edi, edx
jae 0x418a04
mov edx, ecx
mov edi, dword [esp + 0x10]
jmp 0x418a12
mov eax, ecx
cdq
idiv esi
mov edi, 0x10000
sub edi, eax
mov edx, ecx
add dword [esp + 0xc], 0xa
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x3c], eax
mov esi, edi
mov eax, edi
shl eax, 7
add eax, edx
dec eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x48], edx
jmp 0x418a51
mov eax, dword [esp + 0x10]
and edi, 0xfffffff8
dec esi
add eax, 0xffffff80
mov dword [esp + 0x10], eax
mov eax, edi
mul dword [esp + 0x3c]
mov edx, dword [esp + 0x48]
jno 0x418aab
cmp dword [esp + 0x34], 0
je 0x418a85
mov eax, dword [esp + 8]
movzx edi, word [eax + 0x58]
mov eax, esi
imul eax, edi
add eax, edx
dec eax
mov ecx, dword [esp + 0xc]
shr eax, cl
imul eax, edx
xor edx, edx
mov ecx, edi
div edi
mov edi, eax
cmp eax, 9
jae 0x418a36
mov edi, 8
jmp 0x418a36
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
shr edi, cl
imul edi, edx
shr edi, 7
cmp edi, 9
mov eax, 8
cmovb edi, eax
mov eax, dword [esp + 0x10]
mov ecx, 0x80
jmp 0x418a3a
imul ecx, edi
lea eax, [ecx + edx]
dec eax
mov ecx, dword [esp + 0xc]
shr eax, cl
mov ecx, dword [esp + 4]
mov dword [ecx + 0x28], eax
mov esi, dword [esp + 8]
mov dword [esi + 0x28], edi
mov eax, dword [esp + 0x3c]
imul eax, edi
mov dword [esi], eax
mov dword [esi + 0x10], eax
xor edi, edi
test byte [esi + 0x5c], 0x10
mov eax, 0
je 0x418af3
mov ecx, dword [esp + 4]
call fcn.00419020
movzx ecx, byte [esi + 0x18]
mov edx, 0x400
shl edx, cl
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + 0xce]
test ecx, ecx
cmovne eax, ecx
mov word [esi + 0xce], ax
movzx ecx, ax
shr edx, 2
cmp ecx, edx
ja 0x418d34
mov edx, dword [esp + 4]
add ecx, dword [edx + 0x20]
mov edx, dword [esi + 0x20]
lea edx, [edx + edx*2]
shr edx, 2
cmp ecx, edx
mov edx, dword [esp + 4]
jbe 0x418b4e
mov eax, dword [edx + 0x10]
or dword [eax + 0x60], 0x10
mov eax, dword [edx + 0x10]
and dword [eax + 0x5c], 0xffffffef
mov eax, dword [ebp + 0x10]
movzx eax, word [eax + 0xce]
mov word [esi + 0xce], ax
mov esi, dword [edx + 0x10]
mov ecx, dword [edx + 0x28]
movzx eax, ax
mov dword [esp + 0x10], ecx
add eax, ecx
add eax, 3
test byte [esi + 0x60], 0x10
jne 0x418b6b
add eax, dword [edx + 0x20]
jmp 0x418b6c
inc eax
mov ecx, edx
mov esi, dword [esp + 8]
cmp eax, dword [esi + 0x20]
ja 0x418d3e
test byte [esi + 0x5d], 2
mov eax, dword [ecx + 0x1c]
jne 0x418b91
dec eax
push eax
push ecx
call fcn.00413650
add esp, 8
jmp 0x418bb3
cmp eax, 2
jne 0x418ba4
xor eax, eax
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x24c], 0
jmp 0x418bb0
xor eax, eax
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0x250], 0
setne al
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x418bd0
add ecx, 3
movzx eax, word [esi + 0xce]
mov edx, dword [esp + 4]
add ecx, dword [edx + 0x20]
add ecx, eax
jmp 0x418bd3
add ecx, 2
mov dword [esp + 0x10], ecx
push esi
call fcn.00411820
add esp, 4
sub eax, dword [esi + 0x14]
sbb edx, 0
push 0
push dword [esi + 0x20]
push edx
push eax
call fcn.004237d0
add esp, 0x10
mov ecx, dword [esp + 4]
mov esi, dword [ecx + 0x1c]
cmp esi, 1
mov ecx, dword [esp + 0x10]
jne 0x418c11
test eax, eax
je 0x418c11
cmp ecx, eax
ja 0x418423
test eax, eax
je 0x418d48
add ecx, 0x32
cmp ecx, eax
jbe 0x418d48
mov ebx, edx
mov edi, eax
mov esi, dword [esp + 8]
push esi
call fcn.00411820
add esp, 4
sub eax, edi
sbb edx, ebx
push edx
push eax
push esi
call fcn.00411960
add esp, 0xc
mov edi, dword [ebp + 0x10]
push edi
call fcn.004119b0
add esp, 4
movd xmm0, edx
movd xmm1, eax
punpckldq xmm1, xmm0
movdqa xmm0, xmmword [0x492dc0]
punpckldq xmm1, xmm0
movapd xmm0, xmmword [0x492dd0]
subpd xmm1, xmm0
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
movsd xmm0, qword [0x492de0]
mulsd xmm2, xmm0
movapd xmmword [esp + 0x10], xmm2
push edi
call fcn.00411820
add esp, 4
movd xmm0, edx
movd xmm1, eax
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x492dc0]
subpd xmm1, xmmword [0x492dd0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
movapd xmm1, xmmword [esp + 0x10]
divsd xmm1, xmm0
movapd xmmword [esp + 0x10], xmm1
push esi
call fcn.00411820
add esp, 4
movd xmm0, edx
movd xmm1, eax
punpckldq xmm1, xmm0
punpckldq xmm1, xmmword [0x492dc0]
subpd xmm1, xmmword [0x492dd0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mulsd xmm0, qword [esp + 0x10]
divsd xmm0, qword [0x492de0]
movsd xmm1, qword [0x492de8]
ucomisd xmm0, xmm1
jae 0x4187a1
xorpd xmm1, xmm1
jmp 0x4187a1
mov edi, edx
jmp 0x418423
mov ebx, 0x7f2bb75d
jmp 0x418423
mov ebx, 0x7f2bb75b
jmp 0x418423
mov ecx, dword [esp + 8]
test byte [ecx + 0x5d], 2
je 0x418daa
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + 0x24c]
cmp ecx, esi
jb 0x418d6d
lea ecx, [esi - 1]
mov edx, dword [esp + 8]
mov dword [edx + 0x24c], ecx
mov edx, dword [esp + 8]
mov eax, dword [edx + 0x250]
lea ebx, [esi - 1]
cmp eax, esi
cmovb ebx, eax
xor edx, edx
cmp ecx, ebx
cmovne edx, ebx
je 0x418d8c
cmp eax, esi
jb 0x418d96
mov eax, dword [esp + 8]
mov dword [eax + 0x250], edx
cmp ecx, edx
jbe 0x418daa
mov eax, dword [esp + 8]
mov dword [eax + 0x24c], edx
mov dword [eax + 0x250], ecx
mov eax, dword [esp + 4]
mov esi, dword [eax + 0xc]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 0x50
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x41841e
movdqu xmm0, xmmword [0x492e04]
mov ebx, dword [esp + 0x10]
movdqu xmmword [ebx], xmm0
mov word [ebx + 0x10], 0x20
push esi
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 8
mov ecx, dword [esp + 4]
lea eax, [ecx + 0x30]
push eax
push ebx
push ecx
call fcn.0042d070
add esp, 0xc
test eax, eax
jne 0x418e42
movdqu xmm0, xmmword [0x492e16]
mov ebx, dword [esp + 0x10]
movdqu xmmword [ebx], xmm0
mov word [ebx + 0x10], 0x20
mov esi, dword [esp + 4]
push dword [esi + 0xc]
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcat
add esp, 8
mov eax, esi
add eax, 0x2c
push eax
push ebx
push esi
call fcn.0042cf10
add esp, 0xc
test eax, eax
je 0x418e56
mov ebx, eax
mov edi, dword [esp + 0x10]
jmp 0x418423
mov edi, dword [esp + 0x30]
jmp 0x418423
push dword [esp + 0x10]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, dword [esp + 4]
mov esi, dword [eax + 0x14]
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x418e7a
mov eax, ecx
mul esi
jo 0x41841e
imul esi, ecx
push esi
push 1
call sub.api_ms_win_crt_heap_l1_1_0.dll_calloc
add esp, 8
mov ebx, 0x7f2bb746
test eax, eax
je 0x418423
mov ecx, dword [esp + 4]
mov dword [ecx + 0x24], eax
mov eax, dword [ecx + 0x1c]
xor ebx, ebx
test eax, eax
je 0x418fb5
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x64]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], 0
xor edi, edi
jmp 0x418f20
add dword [esp + 0x28], eax
adc dword [esp + 0xc], 0
push eax
push edi
mov esi, dword [esp + 0xc]
push esi
call fcn.00411db0
add esp, 0xc
mov eax, dword [esi + 0x10]
push dword [eax + 0x28]
push edi
push esi
call fcn.00411e30
add esp, 0xc
push 0
push edi
push esi
call fcn.00411ea0
add esp, 0xc
push edi
push esi
call fcn.00413440
add esp, 8
inc edi
mov eax, dword [esi + 0x1c]
cmp edi, eax
jae 0x418fc5
test dword [esp + 0x34], 0x410
je 0x418f83
dec eax
cmp edi, eax
je 0x418f3e
push 2
push edi
push dword [esp + 0xc]
call fcn.00411fd0
add esp, 0xc
push 1
push edi
push dword [esp + 0xc]
call fcn.00411fd0
add esp, 0xc
mov eax, dword [esp + 8]
mov ecx, dword [eax + 0x28]
xor esi, esi
cmp dword [esp + 0x10], 0
je 0x418f6f
mov eax, ecx
sub eax, dword [esp + 0x10]
ja 0x418f71
mov esi, dword [esp + 0x10]
sub esi, ecx
xor eax, eax
jmp 0x418f71
mov eax, ecx
push eax
push edi
push dword [esp + 0xc]
call fcn.00411f20
add esp, 0xc
mov dword [esp + 0x10], esi
mov esi, dword [esp + 4]
push dword [esi + 0x30]
push edi
push esi
call fcn.004328e0
add esp, 0xc
mov ecx, dword [esi + 0x10]
cmp byte [ecx + 0x174], 0
je 0x418ed6
mov ecx, dword [esp + 4]
mov ecx, dword [ecx + 0x28]
add eax, ecx
add eax, 2
jmp 0x418ed6
mov dword [esp + 0x28], 0
mov dword [esp + 0xc], 0
mov esi, dword [esp + 4]
movzx ecx, byte [esi + 0x64]
mov eax, 0xffffffff
shl eax, cl
mov ecx, dword [esp + 0x28]
and ecx, eax
sar eax, 0x1f
and eax, dword [esp + 0xc]
push eax
push ecx
mov edi, dword [esp + 0x10]
push edi
call fcn.00411a60
add esp, 0xc
or byte [edi + 0x160], 1
or byte [esi + 8], 0x36
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push dword [esi + 0x14]
push eax
call dword [ecx + 0x10]
add esp, 8
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
jmp 0x418438