Function at 0x416740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a2d58
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push edi
mov eax, dword [0x4d32ac]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov ecx, dword [esi + 4]
lea eax, [esp + 0x28]
push eax
push ecx
call dword [0x4a7454]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
push 0x4bb0d8
sub eax, 0x12c
cdq
sub eax, edx
mov ebp, eax
lea eax, [esi + 0x1454]
mov ebx, 5
sar ebp, 1
call fcn.00404880
mov eax, 0xc
lea edx, [esp + 0x14]
mov dword [esi + 0x334], ebp
mov dword [esi + 0x338], eax
mov ebx, 4
push edx
mov ecx, 0x4baa38
mov dword [esi + 0x340], eax
mov dword [esi + 0x33c], ebx
call fcn.00404920
lea edi, [esi + 0x348]
lea eax, [esp + 0x14]
mov dword [esp + 0x40], 0
call fcn.00403b10
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41680e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x4bb0e4
call fcn.00404920
lea edi, [esi + 0x358]
lea eax, [esp + 0x14]
mov dword [esp + 0x40], 1
call fcn.00403b10
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41685c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x4aa6a0
mov dword [esi + 0x344], 0
call fcn.00404920
lea edx, [esp + 0x14]
push edx
mov ecx, 0x4aa6a0
mov dword [esp + 0x44], 2
call fcn.00404920
lea eax, [esp + 0x10]
push eax
mov ecx, 0x4bb0f0
mov byte [esp + 0x44], 3
call fcn.00404920
lea edi, [esi + 0x34c]
lea eax, [esp + 0x10]
mov byte [esp + 0x40], bl
call fcn.00403b10
lea edi, [esi + 0x354]
lea eax, [esp + 0x20]
call fcn.00403b10
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], 0
lea edi, [esi + 0x350]
lea eax, [esp + 0x10]
je 0x4168da
lea eax, [esp + 0x14]
call fcn.00403b10
mov byte [esp + 0x40], 3
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416904
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 2
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416929
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416951
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x33c]
imul eax, eax, 0x16
add eax, 0xc
lea ecx, [esp + 0x20]
mov ebx, eax
mov dword [esi + 0x35c], ebp
mov dword [esi + 0x360], ebx
push ecx
mov ecx, 0x4baa38
mov dword [esi + 0x368], 0xc
mov dword [esi + 0x364], 2
call fcn.00404920
lea edi, [esi + 0x370]
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 5
call fcn.00403b10
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4169cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x4bb0e4
call fcn.00404920
lea edi, [esi + 0x380]
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 6
call fcn.00403b10
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416a1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x4aa6a0
mov dword [esi + 0x36c], 2
call fcn.00404920
lea edx, [esp + 0x10]
push edx
mov ecx, 0x4aa6a0
mov dword [esp + 0x44], 7
call fcn.00404920
lea eax, [esp + 0x14]
push eax
mov ecx, 0x4bb1b0
mov byte [esp + 0x44], 8
call fcn.00404920
lea edi, [esi + 0x374]
lea eax, [esp + 0x14]
mov byte [esp + 0x40], 9
call fcn.00403b10
lea edi, [esi + 0x37c]
lea eax, [esp + 0x20]
call fcn.00403b10
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], 0
lea edi, [esi + 0x378]
lea eax, [esp + 0x14]
je 0x416a9a
lea eax, [esp + 0x10]
call fcn.00403b10
mov byte [esp + 0x40], 8
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416ac4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 7
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416ae9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416b11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x364]
imul eax, eax, 0x16
lea ecx, [esp + 0x20]
lea ebx, [ebx + eax + 0xa]
mov dword [esi + 0x384], ebp
mov dword [esi + 0x388], ebx
push ecx
mov ecx, 0x4baa38
mov dword [esi + 0x390], 0xc
mov dword [esi + 0x38c], 2
call fcn.00404920
lea edi, [esi + 0x398]
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 0xa
call fcn.00403b10
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416b8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x4bb0e4
call fcn.00404920
lea edi, [esi + 0x3a8]
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 0xb
call fcn.00403b10
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416bda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x4aa6a0
mov dword [esi + 0x394], 0
call fcn.00404920
lea edx, [esp + 0x10]
push edx
mov ecx, 0x4aa6a0
mov dword [esp + 0x44], 0xc
call fcn.00404920
lea eax, [esp + 0x14]
push eax
mov ecx, 0x4bb210
mov byte [esp + 0x44], 0xd
call fcn.00404920
lea edi, [esi + 0x39c]
lea eax, [esp + 0x14]
mov byte [esp + 0x40], 0xe
call fcn.00403b10
lea edi, [esi + 0x3a4]
lea eax, [esp + 0x20]
call fcn.00403b10
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], 0
lea edi, [esi + 0x3a0]
lea eax, [esp + 0x14]
je 0x416c59
lea eax, [esp + 0x10]
call fcn.00403b10
mov byte [esp + 0x40], 0xd
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416c83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0xc
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416ca8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416cd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x38c]
imul eax, eax, 0x16
lea ecx, [esp + 0x20]
lea ebx, [ebx + eax + 0xa]
mov dword [esi + 0x3ac], ebp
mov dword [esi + 0x3b0], ebx
push ecx
mov ecx, 0x4baa38
mov dword [esi + 0x3b8], 0xc
mov dword [esi + 0x3b4], 3
call fcn.00404920
lea edi, [esi + 0x3c0]
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 0xf
call fcn.00403b10
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416d4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x4bb270
call fcn.00404920
lea edi, [esi + 0x3d0]
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 0x10
call fcn.00403b10
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416d99
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x4aa6a0
mov dword [esi + 0x3bc], 0
call fcn.00404920
lea edx, [esp + 0x10]
push edx
mov ecx, 0x4aa6a0
mov dword [esp + 0x44], 0x11
call fcn.00404920
lea eax, [esp + 0x14]
push eax
mov ecx, 0x4bb278
mov byte [esp + 0x44], 0x12
call fcn.00404920
lea edi, [esi + 0x3c4]
lea eax, [esp + 0x14]
mov byte [esp + 0x40], 0x13
call fcn.00403b10
lea edi, [esi + 0x3cc]
lea eax, [esp + 0x20]
call fcn.00403b10
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], 0
lea edi, [esi + 0x3c8]
lea eax, [esp + 0x14]
je 0x416e18
lea eax, [esp + 0x10]
call fcn.00403b10
mov byte [esp + 0x40], 0x12
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416e42
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0x11
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416e67
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416e8f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi + 0x3b4]
imul eax, eax, 0x16
lea ecx, [esp + 0x20]
lea ebx, [ebx + eax + 0xa]
mov dword [esi + 0x3d4], ebp
mov dword [esi + 0x3d8], ebx
push ecx
mov ecx, 0x4baa38
mov dword [esi + 0x3e0], 0xc
mov dword [esi + 0x3dc], 2
call fcn.00404920
lea edi, [esi + 0x3e8]
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 0x14
call fcn.00403b10
or ebp, 0xffffffff
mov dword [esp + 0x40], ebp
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416f08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x4bb0e4
call fcn.00404920
lea edi, [esi + 0x3f8]
lea eax, [esp + 0x20]
mov dword [esp + 0x40], 0x15
call fcn.00403b10
mov dword [esp + 0x40], ebp
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416f51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, 0x4aa6a0
mov dword [esi + 0x3e4], 0
call fcn.00404920
lea edx, [esp + 0x1c]
push edx
mov ecx, 0x4aa6a0
mov dword [esp + 0x44], 0x16
call fcn.00404920
lea eax, [esp + 0x18]
push eax
mov ecx, 0x4bb2f8
mov byte [esp + 0x44], 0x17
call fcn.00404920
lea edi, [esi + 0x3ec]
lea eax, [esp + 0x18]
mov byte [esp + 0x40], 0x18
call fcn.00403b10
lea edi, [esi + 0x3f4]
lea eax, [esp + 0x24]
call fcn.00403b10
mov ecx, dword [esp + 0x1c]
cmp dword [ecx - 0xc], 0
lea edi, [esi + 0x3f0]
lea eax, [esp + 0x18]
je 0x416fd0
lea eax, [esp + 0x1c]
call fcn.00403b10
mov byte [esp + 0x40], 0x17
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x416ff9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x40], 0x16
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebp
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41701d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x40], ebp
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg 0x41703e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x3dc]
imul ecx, ecx, 0x16
lea edx, [ecx + ebx + 0xc]
mov dword [esi + 0x141c], edx
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x34
ret