Function at 0x407210
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0xffffffffffffffff
push 0x44e92f
mov eax, dword fs:[0]
push eax
mov eax, 0x4da8
call fcn.004468f0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x4dbc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4dcc]
push eax
call fcn.0040f9c0
push 0x1db04001
push 0x60001
lea ecx, [esp + 0x2ac]
push ecx
sub esp, 0x1c
xor ebp, ebp
mov esi, esp
mov dword [esp + 0x4dec], ebp
mov dword [esi + 0x18], 0xf
mov ebx, pe_nt_image_headers32
mov dword [esi + 0x14], ebp
mov dword [esp + 0x5c], esp
lea edi, [esi + 4]
cmp dword [esi + 0x18], ebx
jb 0x40728d
mov eax, dword [edi]
jmp 0x40728f
mov eax, edi
mov byte [eax], 0
mov eax, dword [esi + 0x18]
cmp eax, ebx
jb 0x40729d
mov ecx, dword [edi]
jmp 0x40729f
mov ecx, edi
cmp ecx, 0x453ce4
ja 0x4072d8
cmp eax, ebx
jb 0x4072af
mov ecx, dword [edi]
jmp 0x4072b1
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x453ce4
jbe 0x4072d8
cmp eax, ebx
jb 0x4072c4
mov edi, dword [edi]
push 0xe
mov eax, 0x453ce4
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x40731a
cmp eax, 0xe
jae 0x4072ea
mov ecx, dword [esi + 0x14]
push ecx
push 0xe
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x4072f5
mov eax, dword [edi]
jmp 0x4072f7
mov eax, edi
push 0xe
push 0x453ce4
push ecx
push eax
call fcn.00437feb
add esp, 0x10
mov dword [esi + 0x14], 0xe
cmp dword [esi + 0x18], ebx
jb 0x407316
mov edi, dword [edi]
mov byte [edi + 0xe], 0
lea ecx, [esp + 0x1630]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dd0], 1
call fcn.00402100
mov ebx, 8
mov byte [esp + 0x4dcc], 2
cmp dword [eax + 0x18], ebx
jb 0x40734c
mov eax, dword [eax + 4]
jmp 0x40734f
add eax, 4
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebp
mov dword [esp + 0x58], esp
cmp dword [esi + 0x18], ebx
jb 0x40736c
mov ecx, dword [esi + 4]
jmp 0x40736f
lea ecx, [esi + 4]
xor edx, edx
mov word [ecx], dx
mov ecx, eax
lea edi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x407380
sub ecx, edi
sar ecx, 1
push ecx
call fcn.00410110
lea eax, [esp + 0x140]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e08], 3
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
cmp dword [ecx + 0x18], 0x10
mov dword [esp + 0x70], esp
jb 0x4073c3
mov eax, dword [ecx + 4]
jmp 0x4073c6
lea eax, [ecx + 4]
push 0x24
push 0x453cf4
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x31cc]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dec], 4
call fcn.00402100
mov byte [esp + 0x4de8], 5
cmp dword [eax + 0x18], ebx
jb 0x407402
mov eax, dword [eax + 4]
jmp 0x407405
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x6c], esp
call fcn.0040f980
lea ecx, [esp + 0x38c]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e24], 6
mov ecx, esp
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov esi, pe_nt_image_headers32
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x84], esp
cmp dword [ecx + 0x18], esi
jb 0x407449
mov eax, dword [ecx + 4]
jmp 0x40744c
lea eax, [ecx + 4]
push 0xc
push 0x453d1c
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x15b8]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e08], 7
call fcn.004023a0
mov byte [esp + 0x4e04], bl
cmp dword [eax + 0x18], ebx
jb 0x407487
mov eax, dword [eax + 4]
jmp 0x40748a
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x80], esp
call fcn.0040f980
lea edx, [esp + 0x140]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e40], 9
mov ecx, esp
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x94], esp
cmp dword [ecx + 0x18], esi
jb 0x4074c7
mov eax, dword [ecx + 4]
jmp 0x4074ca
lea eax, [ecx + 4]
push 0x2d
push 0x453d2c
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x3fc4]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e24], 0xa
call fcn.00402100
mov byte [esp + 0x4e20], 0xb
cmp dword [eax + 0x18], ebx
jb 0x407506
mov eax, dword [eax + 4]
jmp 0x407509
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x90], esp
call fcn.0040f980
lea eax, [esp + 0x2e4]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0xc
mov ecx, esp
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb4], esp
cmp dword [ecx + 0x18], esi
jb 0x407546
mov eax, dword [ecx + 4]
jmp 0x407549
lea eax, [ecx + 4]
push 0xc
push 0x453d5c
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x1540]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e40], 0xd
call fcn.00402770
mov byte [esp + 0x4e3c], 0xe
cmp dword [eax + 0x18], ebx
jb 0x407585
mov eax, dword [eax + 4]
jmp 0x407588
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xb0], esp
call fcn.0040f980
lea ecx, [esp + 0x140]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e78], 0xf
mov ecx, esp
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xd4], esp
cmp dword [ecx + 0x18], esi
jb 0x4075c5
mov eax, dword [ecx + 4]
jmp 0x4075c8
lea eax, [ecx + 4]
push 0xd
push str.__G__a
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x318c]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e5c], 0x10
call fcn.00402770
mov byte [esp + 0x4e58], 0x11
cmp dword [eax + 0x18], ebx
jb 0x407604
mov eax, dword [eax + 4]
jmp 0x407607
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xd0], esp
call fcn.0040f980
lea edx, [esp + 0x4a4]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e94], 0x12
mov ecx, esp
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xf8], esp
cmp dword [ecx + 0x18], esi
jb 0x407644
mov eax, dword [ecx + 4]
jmp 0x407647
lea eax, [ecx + 4]
push 0x15
push 0x453d7c
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x14c8]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e78], 0x13
call fcn.00401c70
mov byte [esp + 0x4e74], 0x14
cmp dword [eax + 0x18], ebx
jb 0x407683
mov eax, dword [eax + 4]
jmp 0x407686
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf4], esp
call fcn.0040f980
sub esp, 0x1c
mov byte [esp + 0x4eac], 0x15
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
lea edi, [esp + 0x15c]
mov dword [esp + 0x118], esp
cmp dword [ecx + 0x18], esi
jb 0x4076c6
mov eax, dword [ecx + 4]
jmp 0x4076c9
lea eax, [ecx + 4]
push 9
push 0x453d94
mov byte [eax], 0
call fcn.00403090
lea esi, [esp + 0x4710]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x4e90], 0x16
call fcn.00401a50
mov byte [esp + 0x4e90], 0x17
cmp dword [eax + 0x18], 0x10
jb 0x407708
mov eax, dword [eax + 4]
jmp 0x40770b
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x118], esp
push eax
call fcn.00402b30
sub esp, 0x1c
mov byte [esp + 0x4ec8], 0x18
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
cmp dword [ecx + 0x18], 0x10
lea edi, [esp + 0x3e0]
mov dword [esp + 0x118], esp
jb 0x40774d
mov eax, dword [ecx + 4]
jmp 0x407750
lea eax, [ecx + 4]
push 0xc
push 0x453da0
mov byte [eax], 0
call fcn.00403090
lea esi, [esp + 0x1a7c]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x4eac], 0x19
call fcn.00401640
mov byte [esp + 0x4eac], 0x1a
cmp dword [eax + 0x18], 0x10
jb 0x40778f
mov eax, dword [eax + 4]
jmp 0x407792
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x118], esp
push eax
call fcn.00402b30
mov ecx, dword [esp + 0x4ed0]
mov byte [esp + 0x4ec8], 0x2a
call fcn.0040db30
cmp dword [esp + 0x2f4], 0x10
jb 0x4077d2
mov eax, dword [esp + 0x2e0]
push eax
call fcn.00437f8b
add esp, 4
mov edi, 0xf
lea esi, [esp + 0x1978]
mov dword [esp + 0x2f4], edi
mov dword [esp + 0x2f0], ebp
mov byte [esp + 0x2e0], 0
call fcn.00429620
cmp dword [esp + 0x8c], 0x10
jb 0x407810
mov ecx, dword [esp + 0x78]
push ecx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x4628]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x88], ebp
mov byte [esp + 0x78], 0
call fcn.00429620
cmp dword [esp + 0x40c], ebx
jb 0x407848
mov edx, dword [esp + 0x3f8]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
mov edi, 7
lea esi, [esp + 0x13f8]
mov dword [esp + 0x40c], edi
mov dword [esp + 0x408], ebp
mov word [esp + 0x3f8], ax
call fcn.00429620
cmp dword [esp + 0xc4], ebx
jb 0x40788a
mov ecx, dword [esp + 0xb0]
push ecx
call fcn.00437f8b
add esp, 4
xor edx, edx
lea esi, [esp + 0x30d8]
mov dword [esp + 0xc4], edi
mov dword [esp + 0xc0], ebp
mov word [esp + 0xb0], dx
call fcn.00429620
cmp dword [esp + 0x284], ebx
jb 0x4078c7
mov eax, dword [esp + 0x270]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x14a8]
mov dword [esp + 0x284], edi
mov dword [esp + 0x280], ebp
mov word [esp + 0x270], cx
call fcn.00429620
cmp dword [esp + 0xfc], ebx
jb 0x407904
mov edx, dword [esp + 0xe8]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
lea esi, [esp + 0x3f48]
mov dword [esp + 0xfc], edi
mov dword [esp + 0xf8], ebp
mov word [esp + 0xe8], ax
call fcn.00429620
cmp dword [esp + 0x364], ebx
jb 0x407941
mov ecx, dword [esp + 0x350]
push ecx
call fcn.00437f8b
add esp, 4
xor edx, edx
lea esi, [esp + 0x1558]
mov dword [esp + 0x364], edi
mov dword [esp + 0x360], ebp
mov word [esp + 0x350], dx
call fcn.00429620
cmp dword [esp + 0x134], ebx
jb 0x40797e
mov eax, dword [esp + 0x120]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x3188]
mov dword [esp + 0x134], edi
mov dword [esp + 0x130], ebp
mov word [esp + 0x120], cx
call fcn.00429620
cmp dword [esp + 0x2bc], ebx
jb 0x4079bb
mov edx, dword [esp + 0x2a8]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
lea esi, [esp + 0x1608]
mov dword [esp + 0x2bc], edi
mov dword [esp + 0x2b8], ebp
mov word [esp + 0x2a8], ax
mov byte [esp + 0x4dc4], al
call fcn.00429620
push ebp
call fcn.00439283
add esp, 4
push 0x1db04001
push 0x70002
lea ecx, [esp + 0x23c]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
cmp dword [ecx + 0x18], 0x10
mov dword [esp + 0x3c], esp
jb 0x407a1f
mov eax, dword [ecx + 4]
jmp 0x407a22
lea eax, [ecx + 4]
push 0xf
push str.TZGenAdDwUGO
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x4700]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dd0], 0x2b
call fcn.00401ed0
mov byte [esp + 0x4dcc], 0x2c
cmp dword [eax + 0x18], ebx
jb 0x407a5e
mov eax, dword [eax + 4]
jmp 0x407a61
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
call fcn.0040f980
lea edx, [esp + 0x338]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e08], 0x2d
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov esi, pe_nt_image_headers32
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x74], esp
cmp dword [ecx + 0x18], esi
jb 0x407aa1
mov eax, dword [ecx + 4]
jmp 0x407aa4
lea eax, [ecx + 4]
push 0x1f
push 0x453dc0
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x190c]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dec], 0x2e
call fcn.00401ed0
mov byte [esp + 0x4de8], 0x2f
cmp dword [eax + 0x18], ebx
jb 0x407ae0
mov eax, dword [eax + 4]
jmp 0x407ae3
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.0040f980
lea eax, [esp + 0x23c]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e24], 0x30
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x88], esp
cmp dword [ecx + 0x18], esi
jb 0x407b21
mov eax, dword [ecx + 4]
jmp 0x407b24
lea eax, [ecx + 4]
push 0xd
push 0x453de0
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x3348]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e08], 0x31
call fcn.00402770
mov byte [esp + 0x4e04], 0x32
cmp dword [eax + 0x18], ebx
jb 0x407b60
mov eax, dword [eax + 4]
jmp 0x407b63
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x84], esp
call fcn.0040f980
lea ecx, [esp + 0x3e0]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e40], 0x33
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x9c], esp
cmp dword [ecx + 0x18], esi
jb 0x407ba4
mov eax, dword [ecx + 4]
jmp 0x407ba7
lea eax, [ecx + 4]
push 0x2d
push 0x453df0
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x1894]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e24], 0x34
call fcn.00401c70
mov byte [esp + 0x4e20], 0x35
cmp dword [eax + 0x18], ebx
jb 0x407be3
mov eax, dword [eax + 4]
jmp 0x407be6
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x98], esp
call fcn.0040f980
lea edx, [esp + 0x23c]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0x36
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb4], esp
cmp dword [ecx + 0x18], esi
jb 0x407c27
mov eax, dword [ecx + 4]
jmp 0x407c2a
lea eax, [ecx + 4]
push 5
push 0x453e20
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x4090]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e40], 0x37
call fcn.00402100
mov byte [esp + 0x4e3c], 0x38
cmp dword [eax + 0x18], ebx
jb 0x407c66
mov eax, dword [eax + 4]
jmp 0x407c69
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xb0], esp
call fcn.0040f980
lea eax, [esp + 0xd0]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e78], 0x39
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xcc], esp
cmp dword [ecx + 0x18], esi
jb 0x407caa
mov eax, dword [ecx + 4]
jmp 0x407cad
lea eax, [ecx + 4]
push 0x2e
push 0x453e28
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x181c]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e5c], 0x3a
call fcn.00401c70
mov byte [esp + 0x4e58], 0x3b
cmp dword [eax + 0x18], ebx
jb 0x407ce9
mov eax, dword [eax + 4]
jmp 0x407cec
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xc8], esp
call fcn.0040f980
lea ecx, [esp + 0x23c]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e94], 0x3c
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xf4], esp
cmp dword [ecx + 0x18], esi
jb 0x407d2d
mov eax, dword [ecx + 4]
jmp 0x407d30
lea eax, [ecx + 4]
push 0x15
push 0x453e58
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x3308]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e78], 0x3d
call fcn.00402100
mov byte [esp + 0x4e74], 0x3e
cmp dword [eax + 0x18], ebx
jb 0x407d6c
mov eax, dword [eax + 4]
jmp 0x407d6f
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf0], esp
call fcn.0040f980
lea edx, [esp + 0x488]
push edx
sub esp, 0x1c
mov byte [esp + 0x4eb0], 0x3f
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x118], esp
cmp dword [ecx + 0x18], esi
jb 0x407db0
mov eax, dword [ecx + 4]
jmp 0x407db3
lea eax, [ecx + 4]
push 0x1c
push 0x453e70
mov byte [eax], 0
call fcn.00403090
lea esi, [esp + 0x17a4]
call fcn.004014c0
mov byte [esp + 0x4e94], 0x40
call fcn.00401770
mov byte [esp + 0x4e90], 0x41
cmp dword [eax + 0x18], 0x10
jb 0x407dee
mov eax, dword [eax + 4]
jmp 0x407df1
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x114], esp
push eax
call fcn.00402b30
lea eax, [esp + 0x23c]
push eax
sub esp, 0x1c
mov byte [esp + 0x4ecc], 0x42
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
cmp dword [ecx + 0x18], 0x10
mov dword [esp + 0x13c], esp
jb 0x407e34
mov eax, dword [ecx + 4]
jmp 0x407e37
lea eax, [ecx + 4]
push 9
push 0x453e90
mov byte [eax], 0
call fcn.00403090
lea esi, [esp + 0x4cb0]
call fcn.004014c0
mov byte [esp + 0x4eb0], 0x43
call fcn.004018b0
mov byte [esp + 0x4eac], 0x44
cmp dword [eax + 0x18], 0x10
jb 0x407e72
mov eax, dword [eax + 4]
jmp 0x407e75
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], esp
push eax
call fcn.00402b30
mov ecx, dword [esp + 0x4ed0]
mov byte [esp + 0x4ec8], 0x54
call fcn.0040db30
cmp dword [esp + 0x16c], 0x10
jb 0x407eb5
mov ecx, dword [esp + 0x158]
push ecx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x4ba8]
mov dword [esp + 0x16c], 0xf
mov dword [esp + 0x168], ebp
mov byte [esp + 0x158], 0
call fcn.00429620
cmp dword [esp + 0x3d4], 0x10
jb 0x407ef5
mov edx, dword [esp + 0x3c0]
push edx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x16b8]
mov dword [esp + 0x3d4], 0xf
mov dword [esp + 0x3d0], ebp
mov byte [esp + 0x3c0], 0
call fcn.00429620
cmp dword [esp + 0x1a4], ebx
jb 0x407f34
mov eax, dword [esp + 0x190]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x3238]
mov dword [esp + 0x1a4], edi
mov dword [esp + 0x1a0], ebp
mov word [esp + 0x190], cx
call fcn.00429620
cmp dword [esp + 0x54], ebx
jb 0x407f6b
mov edx, dword [esp + 0x40]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
lea esi, [esp + 0x1768]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], ebp
mov word [esp + 0x40], ax
call fcn.00429620
cmp dword [esp + 0x1dc], ebx
jb 0x407f9f
mov ecx, dword [esp + 0x1c8]
push ecx
call fcn.00437f8b
add esp, 4
xor edx, edx
lea esi, [esp + 0x3ff8]
mov dword [esp + 0x1dc], edi
mov dword [esp + 0x1d8], ebp
mov word [esp + 0x1c8], dx
call fcn.00429620
cmp dword [esp + 0x39c], ebx
jb 0x407fdc
mov eax, dword [esp + 0x388]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x1818]
mov dword [esp + 0x39c], edi
mov dword [esp + 0x398], ebp
mov word [esp + 0x388], cx
call fcn.00429620
cmp dword [esp + 0x214], ebx
jb 0x408019
mov edx, dword [esp + 0x200]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
lea esi, [esp + 0x32e8]
mov dword [esp + 0x214], edi
mov dword [esp + 0x210], ebp
mov word [esp + 0x200], ax
call fcn.00429620
cmp dword [esp + 0x32c], ebx
jb 0x408056
mov ecx, dword [esp + 0x318]
push ecx
call fcn.00437f8b
add esp, 4
xor edx, edx
lea esi, [esp + 0x18c8]
mov dword [esp + 0x32c], edi
mov dword [esp + 0x328], ebp
mov word [esp + 0x318], dx
call fcn.00429620
cmp dword [esp + 0x24c], ebx
jb 0x408093
mov eax, dword [esp + 0x238]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x46d8]
mov dword [esp + 0x24c], edi
mov dword [esp + 0x248], ebp
mov word [esp + 0x238], cx
mov byte [esp + 0x4dc4], cl
call fcn.00429620
push 0xa281588
push 0x50001
lea edx, [esp + 0x220]
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
cmp dword [ecx + 0x18], 0x10
mov dword [esp + 0x3c], esp
jb 0x4080ee
mov eax, dword [ecx + 4]
jmp 0x4080f1
lea eax, [ecx + 4]
push 0xd
push 0x453e9c
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x1c60]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dd0], 0x55
call fcn.00401c70
mov byte [esp + 0x4dcc], 0x56
cmp dword [eax + 0x18], ebx
jb 0x40812d
mov eax, dword [eax + 4]
jmp 0x408130
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
call fcn.0040f980
lea eax, [esp + 0x204]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e08], 0x57
mov ecx, esp
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov edi, pe_nt_image_headers32
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x74], esp
cmp dword [ecx + 0x18], edi
jb 0x408171
mov eax, dword [ecx + 4]
jmp 0x408174
lea eax, [ecx + 4]
push 0x24
push 0x453eac
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x4a8c]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dec], 0x58
call fcn.00401c70
mov byte [esp + 0x4de8], 0x59
cmp dword [eax + 0x18], ebx
jb 0x4081b0
mov eax, dword [eax + 4]
jmp 0x4081b3
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.0040f980
lea ecx, [esp + 0x1e8]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e24], 0x5a
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x88], esp
cmp dword [ecx + 0x18], edi
jb 0x4081ed
mov eax, dword [ecx + 4]
jmp 0x4081f0
lea eax, [ecx + 4]
push 0xb
push 0x453ed4
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x1be8]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e08], 0x5b
call fcn.004023a0
mov byte [esp + 0x4e04], 0x5c
cmp dword [eax + 0x18], ebx
jb 0x40822c
mov eax, dword [eax + 4]
jmp 0x40822f
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x84], esp
call fcn.0040f980
lea edx, [esp + 0x1cc]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e40], 0x5d
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x9c], esp
cmp dword [ecx + 0x18], edi
jb 0x40826c
mov eax, dword [ecx + 4]
jmp 0x40826f
lea eax, [ecx + 4]
push 0x2d
push 0x453ee0
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x34c4]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e24], 0x5e
call fcn.00401ed0
mov byte [esp + 0x4e20], 0x5f
cmp dword [eax + 0x18], ebx
jb 0x4082ab
mov eax, dword [eax + 4]
jmp 0x4082ae
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x98], esp
call fcn.0040f980
lea eax, [esp + 0x1b0]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0x60
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb4], esp
cmp dword [ecx + 0x18], edi
jb 0x4082eb
mov eax, dword [ecx + 4]
jmp 0x4082ee
lea eax, [ecx + 4]
push 0xb
push str.qe__3___v2
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x1b70]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e40], 0x61
call fcn.00401c70
mov byte [esp + 0x4e3c], 0x62
cmp dword [eax + 0x18], ebx
jb 0x40832a
mov eax, dword [eax + 4]
jmp 0x40832d
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xb0], esp
call fcn.0040f980
lea ecx, [esp + 0x194]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e78], 0x63
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xcc], esp
cmp dword [ecx + 0x18], edi
jb 0x40836a
mov eax, dword [ecx + 4]
jmp 0x40836d
lea eax, [ecx + 4]
push 0x15
push 0x453f1c
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x415c]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e5c], 0x64
call fcn.004023a0
mov byte [esp + 0x4e58], 0x65
cmp dword [eax + 0x18], ebx
jb 0x4083a9
mov eax, dword [eax + 4]
jmp 0x4083ac
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xc8], esp
call fcn.0040f980
lea edx, [esp + 0x178]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e94], 0x66
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xf4], esp
cmp dword [ecx + 0x18], edi
jb 0x4083e9
mov eax, dword [ecx + 4]
jmp 0x4083ec
lea eax, [ecx + 4]
push 0x15
push 0x453d7c
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x1af8]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e78], 0x67
call fcn.00401c70
mov byte [esp + 0x4e74], 0x68
cmp dword [eax + 0x18], ebx
jb 0x408428
mov eax, dword [eax + 4]
jmp 0x40842b
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf0], esp
call fcn.0040f980
sub esp, 0x1c
mov byte [esp + 0x4eac], 0x69
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
cmp dword [ecx + 0x18], 0x10
lea edi, [esp + 0x178]
mov dword [esp + 0x114], esp
jb 0x40846c
mov eax, dword [ecx + 4]
jmp 0x40846f
lea eax, [ecx + 4]
push 7
push 0x453f34
mov byte [eax], 0
call fcn.00403090
lea esi, [esp + 0x3480]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x4e90], 0x6a
call fcn.00401a50
mov byte [esp + 0x4e90], 0x6b
cmp dword [eax + 0x18], 0x10
jb 0x4084ae
mov eax, dword [eax + 4]
jmp 0x4084b1
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x114], esp
push eax
call fcn.00402b30
lea eax, [esp + 0x140]
push eax
sub esp, 0x1c
mov byte [esp + 0x4ecc], 0x6c
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov edi, pe_nt_image_headers32
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x13c], esp
cmp dword [ecx + 0x18], edi
jb 0x4084f8
mov eax, dword [ecx + 4]
jmp 0x4084fb
lea eax, [ecx + 4]
push 0xb
push 0x453f3c
mov byte [eax], 0
call fcn.00403090
lea esi, [esp + 0x13f8]
call fcn.004014c0
mov byte [esp + 0x4eb0], 0x6d
call fcn.00401770
mov byte [esp + 0x4eac], 0x6e
cmp dword [eax + 0x18], edi
jb 0x408535
mov eax, dword [eax + 4]
jmp 0x408538
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], esp
push eax
call fcn.00402b30
mov ecx, dword [esp + 0x4ed0]
mov byte [esp + 0x4ec8], 0x7e
call fcn.0040db30
cmp dword [esp + 0x70], edi
jb 0x408571
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x12f0]
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], ebp
mov byte [esp + 0x5c], 0
call fcn.00429620
cmp dword [esp + 0xa8], edi
jb 0x4085a7
mov edx, dword [esp + 0x94]
push edx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x3398]
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], ebp
mov byte [esp + 0x94], 0
call fcn.00429620
cmp dword [esp + 0xe0], ebx
jb 0x4085e6
mov eax, dword [esp + 0xcc]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
mov edi, 7
lea esi, [esp + 0x1a28]
mov dword [esp + 0xe0], edi
mov dword [esp + 0xdc], ebp
mov word [esp + 0xcc], cx
call fcn.00429620
cmp dword [esp + 0x118], ebx
jb 0x408628
mov edx, dword [esp + 0x104]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
lea esi, [esp + 0x40a8]
mov dword [esp + 0x118], edi
mov dword [esp + 0x114], ebp
mov word [esp + 0x104], ax
call fcn.00429620
cmp dword [esp + 0x150], ebx
jb 0x408665
mov ecx, dword [esp + 0x13c]
push ecx
call fcn.00437f8b
add esp, 4
xor edx, edx
lea esi, [esp + 0x1ad8]
mov dword [esp + 0x150], edi
mov dword [esp + 0x14c], ebp
mov word [esp + 0x13c], dx
call fcn.00429620
cmp dword [esp + 0x188], ebx
jb 0x4086a2
mov eax, dword [esp + 0x174]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x3448]
mov dword [esp + 0x188], edi
mov dword [esp + 0x184], ebp
mov word [esp + 0x174], cx
call fcn.00429620
cmp dword [esp + 0x1c0], ebx
jb 0x4086df
mov edx, dword [esp + 0x1ac]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
lea esi, [esp + 0x1b88]
mov dword [esp + 0x1c0], edi
mov dword [esp + 0x1bc], ebp
mov word [esp + 0x1ac], ax
call fcn.00429620
cmp dword [esp + 0x1f8], ebx
jb 0x40871c
mov ecx, dword [esp + 0x1e4]
push ecx
call fcn.00437f8b
add esp, 4
xor edx, edx
lea esi, [esp + 0x4a48]
mov dword [esp + 0x1f8], edi
mov dword [esp + 0x1f4], ebp
mov word [esp + 0x1e4], dx
call fcn.00429620
cmp dword [esp + 0x230], ebx
jb 0x408759
mov eax, dword [esp + 0x21c]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x1c38]
mov dword [esp + 0x230], edi
mov dword [esp + 0x22c], ebp
mov word [esp + 0x21c], cx
call fcn.00429620
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x408792
sub eax, 2
je 0x408792
sub eax, 4
jne 0x408799
push ebp
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0x1db04001
push 0x60001
lea edx, [esp + 0x418]
push edx
sub esp, 0x1c
mov dword [esp + 0x4dec], ebp
mov ecx, esp
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov edi, pe_nt_image_headers32
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x3c], esp
cmp dword [ecx + 0x18], edi
jb 0x4087d5
mov eax, dword [ecx + 4]
jmp 0x4087d8
lea eax, [ecx + 4]
push 0xe
push 0x453ce4
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x3680]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dd0], 0x81
call fcn.00402100
mov byte [esp + 0x4dcc], 0x82
cmp dword [eax + 0x18], ebx
jb 0x408814
mov eax, dword [eax + 4]
jmp 0x408817
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
call fcn.0040f980
lea eax, [esp + 0x3fc]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e08], 0x83
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x74], esp
cmp dword [ecx + 0x18], edi
jb 0x40884e
mov eax, dword [ecx + 4]
jmp 0x408851
lea eax, [ecx + 4]
push 0x24
push 0x453f48
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x1f3c]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dec], 0x84
call fcn.00402770
mov byte [esp + 0x4de8], 0x85
cmp dword [eax + 0x18], ebx
jb 0x40888d
mov eax, dword [eax + 4]
jmp 0x408890
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.0040f980
lea ecx, [esp + 0x3e0]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e24], 0x86
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x88], esp
cmp dword [ecx + 0x18], edi
jb 0x4088ca
mov eax, dword [ecx + 4]
jmp 0x4088cd
lea eax, [ecx + 4]
push 0xc
push 0x453f70
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x47e8]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e08], 0x87
call fcn.00402770
mov byte [esp + 0x4e04], 0x88
cmp dword [eax + 0x18], ebx
jb 0x408909
mov eax, dword [eax + 4]
jmp 0x40890c
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x84], esp
call fcn.0040f980
lea edx, [esp + 0x3c4]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e40], 0x89
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x9c], esp
cmp dword [ecx + 0x18], edi
jb 0x408949
mov eax, dword [ecx + 4]
jmp 0x40894c
lea eax, [ecx + 4]
push 0x2d
push 0x453d2c
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x1ec4]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e24], 0x8a
call fcn.00402100
mov byte [esp + 0x4e20], 0x8b
cmp dword [eax + 0x18], ebx
jb 0x408988
mov eax, dword [eax + 4]
jmp 0x40898b
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x98], esp
call fcn.0040f980
lea eax, [esp + 0x3a8]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0x8c
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb4], esp
cmp dword [ecx + 0x18], edi
jb 0x4089c8
mov eax, dword [ecx + 4]
jmp 0x4089cb
lea eax, [ecx + 4]
push 0xc
push str.W_Re
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x3640]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e40], 0x8d
call fcn.00401c70
mov byte [esp + 0x4e3c], 0x8e
cmp dword [eax + 0x18], ebx
jb 0x408a07
mov eax, dword [eax + 4]
jmp 0x408a0a
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xb0], esp
call fcn.0040f980
lea ecx, [esp + 0x38c]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e78], 0x8f
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xcc], esp
cmp dword [ecx + 0x18], edi
jb 0x408a47
mov eax, dword [ecx + 4]
jmp 0x408a4a
lea eax, [ecx + 4]
push 0x3f
push 0x453f90
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x1e4c]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e5c], 0x90
call fcn.00402770
mov byte [esp + 0x4e58], 0x91
cmp dword [eax + 0x18], ebx
jb 0x408a86
mov eax, dword [eax + 4]
jmp 0x408a89
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xc8], esp
call fcn.0040f980
lea edx, [esp + 0x370]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e94], 0x92
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xf4], esp
cmp dword [ecx + 0x18], edi
jb 0x408ac6
mov eax, dword [ecx + 4]
jmp 0x408ac9
lea eax, [ecx + 4]
push 0x15
push 0x453e58
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x4228]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e78], 0x93
call fcn.00402100
mov byte [esp + 0x4e74], 0x94
cmp dword [eax + 0x18], ebx
jb 0x408b05
mov eax, dword [eax + 4]
jmp 0x408b08
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xf0], esp
call fcn.0040f980
sub esp, 0x1c
mov byte [esp + 0x4eac], 0x95
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebp
cmp dword [ecx + 0x18], 0x10
lea edi, [esp + 0x370]
mov dword [esp + 0x114], esp
jb 0x408b49
mov eax, dword [ecx + 4]
jmp 0x408b4c
lea eax, [ecx + 4]
push ebx
push str.__a0:A_f
mov byte [eax], 0
call fcn.00403090
lea esi, [esp + 0x1dd0]
call fcn.004014c0
mov edx, edi
mov ecx, eax
mov byte [esp + 0x4e90], 0x96
call fcn.00401a50
mov byte [esp + 0x4e90], 0x97
cmp dword [eax + 0x18], 0x10
jb 0x408b8a
mov eax, dword [eax + 4]
jmp 0x408b8d
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x114], esp
push eax
call fcn.00402b30
lea eax, [esp + 0x338]
push eax
sub esp, 0x1c
mov byte [esp + 0x4ecc], 0x98
mov ecx, esp
mov dword [ecx + 0x18], 0xf
mov edi, pe_nt_image_headers32
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x13c], esp
cmp dword [ecx + 0x18], edi
jb 0x408bd4
mov eax, dword [ecx + 4]
jmp 0x408bd7
lea eax, [ecx + 4]
push 0xc
push str.W_aR
mov byte [eax], 0
call fcn.00403090
lea esi, [esp + 0x3600]
call fcn.004014c0
mov byte [esp + 0x4eb0], 0x99
call fcn.00401770
mov byte [esp + 0x4eac], 0x9a
cmp dword [eax + 0x18], edi
jb 0x408c11
mov eax, dword [eax + 4]
jmp 0x408c14
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x138], esp
push eax
call fcn.00402b30
mov ecx, dword [esp + 0x4ed0]
mov byte [esp + 0x4ec8], 0xaa
call fcn.0040db30
cmp dword [esp + 0x268], edi
jb 0x408c53
mov ecx, dword [esp + 0x254]
push ecx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x34f8]
mov dword [esp + 0x268], 0xf
mov dword [esp + 0x264], ebp
mov byte [esp + 0x254], 0
call fcn.00429620
cmp dword [esp + 0x2a0], edi
jb 0x408c92
mov edx, dword [esp + 0x28c]
push edx
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x1ce8]
mov dword [esp + 0x2a0], 0xf
mov dword [esp + 0x29c], ebp
mov byte [esp + 0x28c], 0
call fcn.00429620
cmp dword [esp + 0x2d8], ebx
jb 0x408cd1
mov eax, dword [esp + 0x2c4]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
mov edi, 7
lea esi, [esp + 0x4158]
mov dword [esp + 0x2d8], edi
mov dword [esp + 0x2d4], ebp
mov word [esp + 0x2c4], cx
call fcn.00429620
cmp dword [esp + 0x310], ebx
jb 0x408d13
mov edx, dword [esp + 0x2fc]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
lea esi, [esp + 0x1d98]
mov dword [esp + 0x310], edi
mov dword [esp + 0x30c], ebp
mov word [esp + 0x2fc], ax
call fcn.00429620
cmp dword [esp + 0x348], ebx
jb 0x408d50
mov ecx, dword [esp + 0x334]
push ecx
call fcn.00437f8b
add esp, 4
xor edx, edx
lea esi, [esp + 0x35a8]
mov dword [esp + 0x348], edi
mov dword [esp + 0x344], ebp
mov word [esp + 0x334], dx
call fcn.00429620
cmp dword [esp + 0x380], ebx
jb 0x408d8d
mov eax, dword [esp + 0x36c]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x1e48]
mov dword [esp + 0x380], edi
mov dword [esp + 0x37c], ebp
mov word [esp + 0x36c], cx
call fcn.00429620
cmp dword [esp + 0x3b8], ebx
jb 0x408dca
mov edx, dword [esp + 0x3a4]
push edx
call fcn.00437f8b
add esp, 4
xor eax, eax
lea esi, [esp + 0x4788]
mov dword [esp + 0x3b8], edi
mov dword [esp + 0x3b4], ebp
mov word [esp + 0x3a4], ax
call fcn.00429620
cmp dword [esp + 0x3f0], ebx
jb 0x408e07
mov ecx, dword [esp + 0x3dc]
push ecx
call fcn.00437f8b
add esp, 4
xor edx, edx
lea esi, [esp + 0x1ef8]
mov dword [esp + 0x3f0], edi
mov dword [esp + 0x3ec], ebp
mov word [esp + 0x3dc], dx
call fcn.00429620
cmp dword [esp + 0x428], ebx
jb 0x408e44
mov eax, dword [esp + 0x414]
push eax
call fcn.00437f8b
add esp, 4
xor ecx, ecx
lea esi, [esp + 0x3658]
mov dword [esp + 0x428], edi
mov dword [esp + 0x424], ebp
mov word [esp + 0x414], cx
mov byte [esp + 0x4dc4], cl
call fcn.00429620
push 0x1db04001
push 0x60001
lea edx, [esp + 0x530]
push edx
sub esp, 0x1c
mov ecx, esp
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov edi, pe_nt_image_headers32
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x3c], esp
cmp dword [ecx + 0x18], edi
jb 0x408ea4
mov eax, dword [ecx + 4]
jmp 0x408ea7
lea eax, [ecx + 4]
push 0xe
push 0x453ce4
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x2290]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dd0], 0xab
call fcn.00402100
mov byte [esp + 0x4dcc], 0xac
cmp dword [eax + 0x18], ebx
jb 0x408ee3
mov eax, dword [eax + 4]
jmp 0x408ee6
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
call fcn.0040f980
lea eax, [esp + 0xc14]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e08], 0xad
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x74], esp
cmp dword [ecx + 0x18], edi
jb 0x408f1d
mov eax, dword [ecx + 4]
jmp 0x408f20
lea eax, [ecx + 4]
push 0x24
push 0x453f48
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x37fc]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4dec], 0xae
call fcn.00402770
mov byte [esp + 0x4de8], 0xaf
cmp dword [eax + 0x18], ebx
jb 0x408f5c
mov eax, dword [eax + 4]
jmp 0x408f5f
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
call fcn.0040f980
lea ecx, [esp + 0x530]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e24], 0xb0
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x88], esp
cmp dword [ecx + 0x18], edi
jb 0x408f99
mov eax, dword [ecx + 4]
jmp 0x408f9c
lea eax, [ecx + 4]
push 9
push 0x453fec
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x2218]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e08], 0xb1
call fcn.00401ed0
mov byte [esp + 0x4e04], 0xb2
cmp dword [eax + 0x18], ebx
jb 0x408fd8
mov eax, dword [eax + 4]
jmp 0x408fdb
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x84], esp
call fcn.0040f980
lea edx, [esp + 0x1314]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e40], 0xb3
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0x9c], esp
cmp dword [ecx + 0x18], edi
jb 0x409018
mov eax, dword [ecx + 4]
jmp 0x40901b
lea eax, [ecx + 4]
push 0x2d
push 0x453ff8
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x4d84]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e24], 0xb4
call fcn.004023a0
mov byte [esp + 0x4e20], 0xb5
cmp dword [eax + 0x18], ebx
jb 0x409057
mov eax, dword [eax + 4]
jmp 0x40905a
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x98], esp
call fcn.0040f980
lea eax, [esp + 0x530]
push eax
sub esp, 0x1c
mov byte [esp + 0x4e5c], 0xb6
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xb4], esp
cmp dword [ecx + 0x18], edi
jb 0x409097
mov eax, dword [ecx + 4]
jmp 0x40909a
lea eax, [ecx + 4]
push 9
push 0x454028
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x21a0]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e40], 0xb7
call fcn.00402770
mov byte [esp + 0x4e3c], 0xb8
cmp dword [eax + 0x18], ebx
jb 0x4090d6
mov eax, dword [eax + 4]
jmp 0x4090d9
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xb0], esp
call fcn.0040f980
lea ecx, [esp + 0xc4c]
push ecx
sub esp, 0x1c
mov byte [esp + 0x4e78], 0xb9
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xcc], esp
cmp dword [ecx + 0x18], edi
jb 0x409116
mov eax, dword [ecx + 4]
jmp 0x409119
lea eax, [ecx + 4]
push 0x15
push 0x454034
mov byte [eax], 0
call fcn.00403090
lea ecx, [esp + 0x37bc]
call fcn.00406790
mov ecx, eax
mov byte [esp + 0x4e5c], 0xba
call fcn.00401c70
mov byte [esp + 0x4e58], 0xbb
cmp dword [eax + 0x18], ebx
jb 0x409155
mov eax, dword [eax + 4]
jmp 0x409158
add eax, 4
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0xc8], esp
call fcn.0040f980
lea edx, [esp + 0x530]
push edx
sub esp, 0x1c
mov byte [esp + 0x4e94], 0xbc
mov ecx, esp
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebp
mov dword [esp + 0xf4], esp
cmp dword [ecx + 0x18], edi
jb 0x409195