Function at 0x40fbb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov dword [esp + 0x74], 0
mov ebx, dword [esp + 0xa0]
mov ebx, dword [ebx + 4]
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0xa0]
mov ebx, dword [eax]
test ebx, ebx
je 0x40fc45
mov eax, ebx
dec eax
js 0x4107e2
sar eax, 5
lea esi, [eax + 1]
mov ecx, esi
test esi, esi
js 0x4107db
mov ebp, dword [esp + 0x34]
imul ebp, ecx
shl ebp, 2
jns 0x40fc24
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
mov dword [esp + 0x5c], 0
jmp 0x410466
mov eax, dword [esp + 0x34]
test eax, eax
je 0x40fc3f
test ecx, ecx
je 0x40fc3f
mov eax, ebp
cdq
idiv dword [esp + 0x34]
cdq
idiv ecx
cmp eax, 4
jne 0x40fc0a
test ebp, ebp
je 0x40fc47
jmp 0x40fc4c
xor esi, esi
mov ebp, 1
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
mov dword [esp + 0x5c], eax
test eax, eax
je 0x40fc15
mov dword [eax], ebx
mov edx, dword [esp + 0x34]
mov dword [eax + 4], edx
mov dword [eax + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], 1
call sub.msvcrt.dll_calloc
mov ebp, eax
mov eax, dword [esp + 0x5c]
mov dword [eax + 0xc], ebp
test ebp, ebp
je 0x4107ea
mov edx, dword [esp + 0xa0]
mov eax, dword [edx + 4]
test eax, eax
jle 0x40fcf3
mov ebx, dword [edx + 8]
xor edx, edx
mov eax, ebp
mov ebp, dword [esp + 0x5c]
mov edi, ebx
mov ebx, dword [esp + 0xa0]
jmp 0x40fcba
mov esi, dword [ebp + 8]
mov edi, dword [ebx + 8]
mov eax, dword [ebp + 0xc]
mov ecx, esi
imul ecx, edx
lea eax, [eax + ecx*4]
lea ecx, [esi*4]
imul edi, edx
mov esi, dword [ebx + 0xc]
lea esi, [esi + edi*4]
mov edi, eax
rep movsb byte es:[edi], byte [esi]
inc edx
cmp edx, dword [ebx + 4]
jl 0x40fcb1
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x5c]
mov ebx, dword [eax]
mov ebp, dword [eax + 0xc]
mov esi, dword [eax + 8]
test bl, 0x1f
je 0x40fd3e
mov eax, ebx
and eax, 0x8000001f
js 0x4107d1
mov ecx, 0x20
sub ecx, eax
mov edx, 0xffffffff
shl edx, cl
mov eax, dword [esp + 0x34]
test eax, eax
jle 0x40fd3e
lea edi, [esi*4]
test ebx, ebx
js 0x4106ac
sar ebx, 5
lea eax, [ebp + ebx*4]
xor ecx, ecx
and dword [eax], edx
inc ecx
add eax, edi
cmp ecx, dword [esp + 0x34]
jne 0x40fd33
mov ebx, dword [esp + 0x34]
dec ebx
mov dword [esp + 0x50], ebx
xor edi, edi
lea ebx, [esp + 0x74]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x30], ebp
mov ebp, dword [esp + 0x5c]
and edi, 0xffffffe0
mov ebx, dword [esp + 0x50]
test ebx, ebx
js 0x41019c
mov eax, dword [ebp]
mov ebx, esi
neg ebx
mov edx, dword [esp + 0x50]
imul edx, esi
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x30]
cmp edi, eax
jge 0x4101ac
test edi, edi
jns 0x40fd9b
jmp 0x4101ac
add edi, 0x20
cmp edi, eax
jge 0x4101ac
mov ecx, edi
sar ecx, 5
add ecx, edx
mov ecx, dword [esi + ecx*4]
test ecx, ecx
je 0x40fd90
mov esi, dword [esp + 0x34]
mov ecx, edi
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], edx
nop
cmp ecx, eax
jge 0x40fde8
cmp esi, dword [esp + 0x50]
jle 0x40fde8
mov ebx, ecx
test ecx, ecx
js 0x4101a4
sar ebx, 5
mov edi, 0x80000000
shr edi, cl
mov ebp, dword [esp + 0x38]
add ebp, ebx
mov edx, dword [esp + 0x30]
test dword [edx + ebp*4], edi
jne 0x40fdeb
lea esi, [esi]
inc ecx
jmp 0x40fdb8
mov eax, ecx
mov ecx, edi
mov ebp, dword [esp + 0x34]
mov edi, eax
mov eax, dword [esp + 0xa0]
cmp dword [eax], edi
jle 0x41042b
mov eax, dword [esp + 0x50]
test eax, eax
js 0x41042b
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0xa0]
cmp dword [eax + 4], edx
jle 0x41042b
mov eax, edx
mov edx, dword [esp + 0xa0]
imul eax, dword [edx + 8]
add ebx, eax
mov eax, dword [edx + 0xc]
and ecx, dword [eax + ebx*4]
cmp ecx, 1
sbb ebx, ebx
and ebx, 2
add ebx, 0x2b
mov dword [esp + 0x60], ebx
mov ebx, dword [esp + 0xa8]
mov ebx, dword [ebx + 4]
mov dword [esp + 0x54], ebx
mov ebx, dword [esp + 0x50]
inc ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x30], ebx
mov ebx, edi
mov dword [esp + 0x48], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x34], 0
mov esi, 0xffffffff
mov dword [esp + 0x40], 0
mov dword [esp + 0x4c], edi
xor edi, edi
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x34], eax
jge 0x40ffbb
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x48]
lea eax, [edx + ecx*8]
mov dword [eax], ebx
mov ecx, dword [esp + 0x30]
mov dword [eax + 4], ecx
inc dword [esp + 0x34]
add ebx, edi
add ecx, esi
mov dword [esp + 0x30], ecx
mov eax, ebx
imul eax, esi
cdq
add dword [esp + 0x38], eax
adc dword [esp + 0x3c], edx
cmp ebx, dword [esp + 0x4c]
je 0x410070
lea eax, [esi + edi - 1]
mov edx, eax
shr edx, 0x1f
add edx, eax
sar edx, 1
mov dword [esp + 0x18], edx
mov ecx, edx
add ecx, ebx
js 0x410010
cmp ecx, dword [ebp]
jge 0x410010
mov eax, esi
sub eax, edi
lea edx, [eax - 1]
mov eax, edx
shr eax, 0x1f
mov dword [esp + 0x40], eax
add eax, edx
sar eax, 1
mov edx, dword [esp + 0x30]
add edx, eax
js 0x410010
cmp edx, dword [ebp + 4]
jge 0x410010
mov eax, ecx
sar eax, 5
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 8]
imul eax, edx
add eax, dword [esp + 0x40]
mov edx, 0x80000000
shr edx, cl
mov ecx, dword [ebp + 0xc]
test dword [ecx + eax*4], edx
setne al
movzx eax, al
mov dword [esp + 0x40], eax
lea esi, [esi]
mov eax, edi
sub eax, esi
dec eax
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, ebx
js 0x40ff7b
cmp ecx, dword [ebp]
jl 0x410020
mov eax, dword [esp + 0x40]
test eax, eax
je 0x40ffa5
cmp dword [esp + 0x54], 3
je 0x410063
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x4106f4
cmp dword [esp + 0x60], 0x2b
je 0x410063
mov eax, esi
neg eax
mov esi, edi
mov edi, eax
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x34], eax
jl 0x40feae
add eax, 0x64
fld qword [0x427540]
push eax
fimul dword [esp]
pop eax
fnstcw word [esp + 0x6a]
mov ax, word [esp + 0x6a]
mov ah, 0xc
mov word [esp + 0x68], ax
fldcw word [esp + 0x68]
fistp dword [esp + 0x44]
fldcw word [esp + 0x6a]
mov eax, dword [esp + 0x44]
shl eax, 3
mov dword [esp + 4], eax
mov edx, dword [esp + 0x48]
mov dword [esp], edx
call sub.msvcrt.dll_realloc
test eax, eax
je 0x410438
mov dword [esp + 0x48], eax
jmp 0x40feae
mov dword [esp + 0x40], 0
jmp 0x40ff60
mov edx, dword [esp + 0x18]
add edx, dword [esp + 0x30]
js 0x40ff7b
cmp edx, dword [ebp + 4]
jge 0x40ff7b
mov eax, ecx
sar eax, 5
imul edx, dword [ebp + 8]
add eax, edx
mov edx, 0x80000000
shr edx, cl
mov ecx, edx
mov edx, dword [ebp + 0xc]
test dword [edx + eax*4], ecx
je 0x40ff7b
mov eax, dword [esp + 0x40]
test eax, eax
je 0x40fea0
mov eax, edi
neg eax
mov edi, esi
mov esi, eax
jmp 0x40fea0
cmp dword [esp + 0x58], ecx
jne 0x40fee6
mov edi, dword [esp + 0x4c]
call fcn.0041450c
mov ebx, eax
test eax, eax
je 0x410438
mov eax, dword [eax + 0x20]
mov ecx, dword [esp + 0x48]
mov dword [eax + 4], ecx
mov edx, dword [esp + 0x34]
mov dword [eax], edx
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
cmp edx, 0
ja 0x4100b1
cmp eax, 0x7fffffff
jbe 0x4100b6
mov eax, 0x7fffffff
mov dword [ebx], eax
mov ecx, dword [esp + 0x60]
mov dword [ebx + 4], ecx
lea edx, [ebx + 0x20]
mov eax, ebp
call fcn.0040fa80
mov eax, dword [esp + 0xa8]
mov eax, dword [eax]
cmp dword [ebx], eax
jle 0x4104a6
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
mov dword [ebx + 0x14], eax
mov dword [ecx], ebx
add ebx, 0x14
mov dword [esp + 0x64], ebx
mov ebx, dword [ebp + 4]
mov dword [esp + 0x34], ebx
test ebx, ebx
jle 0x410183
fild dword [esp + 0x34]
fidivr dword [esp + 0x50]
fld1
fsubr st(1), st(0)
mov esi, dword [esp + 0xac]
test esi, esi
je 0x410175
mov ebx, dword [esp + 0xac]
mov edx, dword [ebx]
test edx, edx
je 0x41017b
fld st(0)
fsub st(2)
fmul qword [ebx + 8]
fld qword [ebx + 0x10]
fmul st(3)
faddp st(1)
fxch st(2)
fucompp
fnstsw ax
and ah, 0x45
cmp ah, 0x40
je 0x41014e
fld qword [ebx + 0x28]
fadd qword [ebx + 0x18]
fxch st(1)
fucom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jne 0x410181
mov ebx, dword [esp + 0xac]
mov eax, dword [ebx + 4]
mov dword [esp + 8], eax
fst qword [esp]
fstp qword [esp + 0x20]
call edx
fld qword [esp + 0x20]
fstp qword [ebx + 0x28]
mov ebx, dword [ebp + 4]
mov dword [esp + 0x34], ebx
jmp 0x410183
fstp st(0)
fstp st(0)
jmp 0x410183
fstp st(0)
fstp st(0)
jmp 0x410183
fstp st(0)
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x30], eax
and edi, 0xffffffe0
mov ebx, dword [esp + 0x50]
test ebx, ebx
jns 0x40fd68
mov ebp, dword [esp + 0x30]
jmp 0x4101c5
lea ebx, [ecx + 0x1f]
jmp 0x40fdcc
dec dword [esp + 0x50]
add edx, ebx
xor edi, edi
cmp dword [esp + 0x50], 0xffffffff
jne 0x40fd7e
mov ebp, esi
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x74]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x78], ebx
mov ecx, esi
test esi, esi
jns 0x4101d9
neg ecx
mov ebx, dword [esp + 0x34]
imul ebx, ecx
shl ebx, 2
js 0x410682
mov edi, dword [esp + 0x34]
test edi, edi
je 0x4104b3
test ecx, ecx
je 0x4106ef
mov eax, ebx
cdq
idiv dword [esp + 0x34]
cdq
idiv ecx
cmp eax, 4
je 0x4106ef
mov ecx, 0xffffffff
test esi, esi
js 0x41069b
xor eax, eax
mov edi, ebp
rep stosb byte es:[edi], al
mov edx, dword [esp + 0x4c]
test edx, edx
jne 0x4104c7
mov ebx, dword [esp + 0x4c]
mov dword [esp + 0x34], ebx
mov esi, dword [esp + 0x5c]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4104ff
mov ebx, dword [esp + 0x34]
mov ebx, dword [ebx + 0x18]
mov dword [esp + 0x48], ebx
mov ebx, dword [esp + 0x34]
mov dword [ebx + 0x18], 0
mov ebp, dword [ebx + 0x14]
mov dword [ebx + 0x14], 0
mov edx, ebx
add edx, 0x20
mov eax, esi
call fcn.0040fa80
mov eax, dword [ebx + 0x20]
mov edx, dword [eax]
test edx, edx
jle 0x4105e0
mov eax, dword [eax + 4]
lea edx, [eax + edx*8]
mov dword [esp + 0x38], edx
xor edi, edi
mov ebx, 0x7fffffff
mov dword [esp + 0x44], 0
mov dword [esp + 0x30], 0x7fffffff
mov dword [esp + 0x40], esi
mov esi, 0x7fffffff
mov dword [esp + 0x50], ebp
xor ebp, ebp
mov ecx, dword [eax]
mov edx, dword [eax + 4]
cmp ebx, ecx
jle 0x4102bb
mov ebx, ecx
cmp edi, ecx
jge 0x4102c1
mov edi, ecx
cmp esi, edx
jle 0x4102c7
mov esi, edx
cmp ebp, edx
jge 0x4102cd
mov ebp, edx
add eax, 8
cmp eax, dword [esp + 0x38]
jne 0x4102b0
mov dword [esp + 0x30], esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x44], ebp
mov ebp, dword [esp + 0x50]
test ebx, ebx
js 0x4105ac
sar ebx, 5
mov dword [esp + 0x40], ebx
mov edx, edi
add edx, 0x1f
js 0x4105c1
sar edx, 5
mov ebx, dword [esp + 0x34]
add ebx, 0x18
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x34]
add eax, 0x14
test ebp, ebp
je 0x4103b9
mov ebx, dword [ebp + 0x14]
mov dword [ebp + 0x14], 0
mov ecx, dword [ebp + 0x20]
mov ecx, dword [ecx + 4]
mov edi, dword [ecx + 4]
cmp edi, dword [esp + 0x30]
jle 0x4105ff
mov dword [esp + 0x50], edx
jmp 0x41039d
test edi, edi
jle 0x4103a7
cmp dword [esi + 4], edi
jl 0x4103a7
dec edi
imul edi, dword [esi + 8]
mov edx, ecx
sar edx, 5
add edi, edx
mov edx, 0x80000000
shr edx, cl
mov ecx, edx
mov edx, dword [esi + 0xc]
test dword [edx + edi*4], ecx
je 0x4103a7
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov dword [ebp + 0x14], edx
mov dword [ecx], ebp
add ebp, 0x14
mov dword [esp + 0x38], ebp
test ebx, ebx
je 0x4103b5
mov edx, dword [ebx + 0x14]
mov dword [ebx + 0x14], 0
mov ecx, dword [ebx + 0x20]
mov ecx, dword [ecx + 4]
mov edi, dword [ecx + 4]
mov ebp, ebx
cmp edi, dword [esp + 0x30]
jle 0x41059c
mov ebx, edx
mov ecx, dword [ecx]
test ecx, ecx
js 0x4103a7
cmp ecx, dword [esi]
jl 0x410340
mov edx, dword [eax]
mov dword [ebp + 0x14], edx
mov dword [eax], ebp
lea eax, [ebp + 0x14]
test ebx, ebx
jne 0x41037c
mov edx, dword [esp + 0x50]
mov ebx, dword [esp + 0x30]
cmp dword [esp + 0x44], ebx
jle 0x4103f5
mov ebx, dword [esp + 0x30]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
nop
cmp edx, edi
jle 0x4103f0
mov ecx, dword [esi + 8]
imul ecx, ebx
mov eax, dword [esi + 0xc]
lea ecx, [eax + ecx*4]
mov eax, edi
nop
mov dword [ecx + eax*4], 0
inc eax
cmp eax, edx
jne 0x4103e4
inc ebx
cmp ebx, ebp
jne 0x4103d0
mov ebx, dword [esp + 0x34]
mov edx, dword [ebx + 0x14]
test edx, edx
je 0x4104e4
mov ebx, dword [esp + 0x48]
mov dword [edx + 0x18], ebx
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x48], edx
test eax, eax
jne 0x4105c9
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x34], ebx
jmp 0x410247
mov dword [esp + 0x60], 0x2d
jmp 0x40fe48
mov ebx, dword [esp + 0x48]
mov dword [esp], ebx
call sub.msvcrt.dll_free
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 0xc]
test eax, eax
je 0x410466
mov ecx, dword [esp + 0x5c]
mov edx, dword [ecx + 8]
test edx, edx
js 0x4106d8
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x74]
test eax, eax
je 0x410496
mov ebx, dword [eax + 0x14]
mov dword [esp + 0x74], ebx
mov dword [eax + 0x14], 0
mov dword [esp], eax
call fcn.00414578
mov eax, ebx
test ebx, ebx
jne 0x41047a
mov eax, 0xffffffff
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call fcn.00414578
jmp 0x4100ec
mov ecx, ebx
xor eax, eax
mov edi, ebp
rep stosb byte es:[edi], al
mov edx, dword [esp + 0x4c]
test edx, edx
je 0x41022f
mov eax, dword [esp + 0x4c]
mov edx, dword [eax + 0x14]
mov dword [eax + 0x1c], edx
mov dword [eax + 0x18], 0
mov eax, edx
test edx, edx
jne 0x4104cb
jmp 0x41022f
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x4105c9
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x41041e
mov edi, dword [esp + 0x78]
test edi, edi
je 0x410605
mov edx, edi
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x14]
mov dword [edx + 0x1c], ecx
mov edx, eax
test eax, eax
jne 0x41050d
mov dword [edi + 0x14], 0
mov dword [esp + 0x78], 0
xor edx, edx
lea esi, [esp + 0x78]
mov dword [esp + 0x7c], eax
lea esi, [esi]
mov dword [edi + 0x14], edx
mov dword [esi], edi
lea esi, [edi + 0x14]
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x41057e
nop
mov edx, dword [esi]
mov dword [ecx + 0x14], edx
mov dword [esi], ecx
lea esi, [ecx + 0x14]
mov ebx, dword [ecx + 0x18]
test ebx, ebx
je 0x410577
test eax, eax
je 0x410589
lea esi, [esi]
lea edx, [eax + 0x14]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x410560
mov dword [ebx + 0x14], 0
mov dword [edx], ebx
mov eax, dword [esp + 0x7c]
mov ecx, dword [ecx + 0x1c]
test ecx, ecx
jne 0x410548
mov edi, dword [edi + 0x1c]
test edi, edi
je 0x41058f
mov edx, dword [esi]
jmp 0x410538
lea edx, [esp + 0x7c]
jmp 0x41056a
test eax, eax
je 0x410605
mov edx, dword [esi]
mov edi, eax
mov eax, dword [eax + 0x14]
jmp 0x410531
mov ecx, edx
mov edx, dword [esp + 0x50]
mov dword [eax], ebx
mov dword [ebx + 0x14], ecx
jmp 0x4103b9
add ebx, 0x1f
sar ebx, 5
mov dword [esp + 0x40], ebx
mov edx, edi
add edx, 0x1f
jns 0x410300
lea edx, [edi + 0x3e]
jmp 0x410300
mov ebx, dword [esp + 0x48]
mov dword [eax + 0x18], ebx
mov ebx, dword [esp + 0x34]
mov ebx, dword [ebx + 0x18]
mov dword [esp + 0x34], ebx
jmp 0x41023b
xor edx, edx
mov dword [esp + 0x40], 0x3ffffff
mov dword [esp + 0x44], 0
mov dword [esp + 0x30], 0x7fffffff
jmp 0x410303
mov ecx, ebx
mov ebx, ebp
jmp 0x4105a2
mov edx, dword [esp + 0x5c]
mov eax, dword [edx + 0xc]
test eax, eax
je 0x410625
mov ecx, edx
mov edx, dword [edx + 8]
test edx, edx
js 0x4106c1
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0xa4]
mov ebx, dword [esp + 0x4c]
mov dword [eax], ebx
mov eax, dword [esp + 0xac]
test eax, eax
je 0x4106b4
mov ebx, dword [esp + 0xac]
mov eax, dword [ebx]
test eax, eax
je 0x4106b4
fldz
fmul qword [ebx + 8]
fadd qword [ebx + 0x10]
mov edx, dword [ebx + 4]
mov dword [esp + 8], edx
fst qword [esp]
fstp qword [esp + 0x20]
call eax
fld qword [esp + 0x20]
fstp qword [ebx + 0x28]
xor eax, eax
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0xffffffff
test esi, esi
jns 0x4104b5
mov ebx, dword [esp + 0x34]
test ebx, ebx
je 0x4104b5
mov edi, dword [esp + 0x34]
dec edi
imul edi, esi
lea ebp, [ebp + edi*4]
jmp 0x4104b5
add ebx, 0x1f
jmp 0x40fd2a
xor eax, eax
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x41061d
dec ecx
imul edx, ecx
lea eax, [eax + edx*4]
jmp 0x41061d
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x41045e
dec ecx
imul edx, ecx
lea eax, [eax + edx*4]
jmp 0x41045e
mov ecx, ebx
jmp 0x410687
cmp dword [esp + 0x54], 1
jne 0x410713
cmp dword [esp + 0x60], 0x2d
je 0x410063
mov eax, esi
neg eax
mov esi, edi
mov edi, eax
jmp 0x40ffad
cmp dword [esp + 0x54], 6
jne 0x4107a8
lea eax, [ebx + ebx*8]
lea eax, [ebx + eax*2]
lea eax, [eax + eax*4]
lea eax, [ebx + eax*8]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, ebx
lea eax, [eax + eax*8]
lea eax, [ebx + eax*2]
lea eax, [eax + eax*8]
lea eax, [ebx + eax*4]
lea eax, [ebx + eax*4]
xor eax, dword [esp + 0x30]
lea edx, [eax + eax*4]
lea edx, [eax + edx*2]
lea edx, [eax + edx*8]
lea edx, [eax + edx*8]
lea edx, [eax + edx*4]
lea edx, [eax + edx*4]
lea edx, [eax + edx*8]
lea edx, [eax + edx*4]
mov ecx, edx
shl ecx, 6
add edx, ecx
shl edx, 2
sub edx, eax
movzx eax, dh
mov ecx, edx
shr ecx, 0x10
and ecx, 0xff
mov al, byte [eax + 0x427440]
xor al, byte [ecx + 0x427440]
movzx ecx, dl
xor al, byte [ecx + 0x427440]
shr edx, 0x18
cmp al, byte [edx + 0x427440]
je 0x40ffa5
mov eax, edi
neg eax
mov edi, esi
mov esi, eax
jmp 0x40fea0
cmp dword [esp + 0x54], 5
jne 0x4107f7
mov ecx, dword [esp + 0x30]
mov edx, ebx
mov eax, ebp
call fcn.0040f7ac
test eax, eax
je 0x40ffa5
mov eax, edi
neg eax
mov edi, esi
mov esi, eax
jmp 0x40fea0
dec eax
or eax, 0xffffffe0
inc eax
jmp 0x40fd05
neg ecx
jmp 0x40fbfe
lea eax, [ebx + 0x1e]
jmp 0x40fbee
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x40fc15
cmp dword [esp + 0x54], 4
jne 0x40ffa5
mov ecx, dword [esp + 0x30]
mov edx, ebx
mov eax, ebp
call fcn.0040f7ac
test eax, eax
jne 0x40ffa5
mov eax, edi
neg eax
mov edi, esi
mov esi, eax
jmp 0x40fea0