Function at 0x406220
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x314
mov eax, dword [0x43a004]
xor eax, esp
mov dword [esp + 0x310], eax
push ebx
push esi
push edi
lea eax, [esp + 0xf8]
mov edi, ecx
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetStdHandle]
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x18], edi
push 0xfffffffffffffff5
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], eax
call eax
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov dword [esp + 0x30], eax
call eax
test eax, eax
jne 0x4062f3
push 0xfffffffffffffff6
call dword [esp + 0x20]
mov ecx, eax
mov esi, edi
mov dword [esp + 0x44], ecx
push 0
lea eax, [esp + 0x4c]
push eax
push 1
lea eax, [esp + 0x40]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4062dc
cmp dword [esp + 0x48], 0
je 0x4062dc
push 1
push esi
push 1
lea eax, [esp + 0x40]
push eax
push 0
push dword [0x44a1cc]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc ebx
add esi, 2
cmp byte [esp + 0x34], 0xa
je 0x4062d1
mov ecx, dword [esp + 0x44]
cmp ebx, 0x1fff
jl 0x406282
xor eax, eax
mov word [edi + ebx*2], ax
jmp 0x4075bd
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.0041d22b
mov esp, ebp
pop ebp
ret
movzx eax, word [esp + 0xf8]
mov word [0x44a1d6], ax
movzx eax, word [esp + 0xfa]
mov word [0x44a1d4], ax
movzx eax, word [esp + 0xfc]
mov dword [esp + 0x38], eax
movzx eax, ax
push 0x3ffe
mov dword [esp + 0x70], eax
movzx eax, word [esp + 0x102]
push 0
push edi
mov dword [esp + 0x38], eax
call fcn.0041e550
add esp, 0xc
mov dword [esp + 0xac], 1
cmp dword [0x43b038], ebx
mov ecx, 0xa
mov eax, 0x63
cmovne eax, ecx
mov dword [esp + 0xa8], eax
lea eax, [esp + 0xa8]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov dword [esp + 0x50], eax
call eax
mov eax, dword [esp + 0x6c]
movzx edi, ax
mov eax, dword [esp + 0x2c]
movzx eax, ax
mov dword [esp + 0x10], eax
mov eax, dword [sym.imp.USER32.dll_MessageBeep]
mov dword [esp + 0xb0], eax
mov eax, dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov dword [esp + 0xa4], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
mov dword [esp + 0x18], edi
mov dword [esp + 0x30], eax
nop dword [eax]
nop dword [eax + eax]
push 0xfffffffffffffff6
mov dword [esp + 0x44], 0
call dword [esp + 0x20]
mov edi, dword [esp + 0xa4]
mov esi, eax
nop word [eax + eax]
lea eax, [esp + 0xa8]
push eax
push 1
lea eax, [esp + 0xec]
push eax
push esi
call edi
cmp word [esp + 0xe4], 1
jne 0x4063e0
cmp dword [esp + 0xe8], 0
je 0x4063e0
mov ecx, dword [esp + 0xf4]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x34], ecx
test cl, 0xf
je 0x406496
movzx eax, word [esp + 0xee]
sub eax, 0x44
je 0x406513
sub eax, 7
je 0x4064c4
sub eax, 2
jne 0x406496
test cl, 0xc
je 0x406496
mov eax, dword [esp + 0x14]
cmp word [eax], 0
je 0x40645d
mov edx, eax
xor ecx, ecx
call fcn.004101a0
mov eax, dword [esp + 0x14]
mov ecx, 0xa
mov dword [esp + 0x3c], 0xa
mov word [eax + ebx*2], cx
inc ebx
xor ecx, ecx
mov dword [esp + 0x24], ebx
push 1
mov word [eax + ebx*2], cx
lea eax, [esp + 0x40]
push eax
push 0x44a060
call fcn.0041c900
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x40], 1
mov edx, dword [esp + 0x10]
movzx eax, word [esp + 0xee]
add eax, 0xfffffff8
mov dword [esp + 0x3c], 0
cmp eax, 0x6a
ja case.0x4064bd.10
movzx eax, byte [eax + 0x407614]
jmp dword [eax*4 + 0x4075d8]
test cl, 0xc
je 0x406496
mov ebx, dword [esp + 0x14]
cmp word [ebx], 0
je 0x4064dc
mov edx, ebx
xor ecx, ecx
call fcn.004101a0
push dword [esp + 0x2c]
mov edi, dword [esp + 0x3c]
mov ecx, ebx
push edi
call fcn.00406150
mov eax, dword [esp + 0x34]
xor ebx, ebx
mov ecx, dword [esp + 0x3c]
add esp, 8
xor esi, esi
movzx edi, di
movzx edx, ax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edx
jmp 0x40649a
test cl, 0xc
je 0x406496
push dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
mov ecx, edi
push dword [esp + 0x3c]
call fcn.00406150
mov edx, dword [0x441ec8]
add esp, 8
test edx, edx
je 0x4065f1
mov esi, dword [0x441ed4]
mov ebx, dword [0x441ecc]
cmp esi, ebx
jne 0x406553
mov esi, dword [ebx + 4]
mov ecx, dword [0x441ed0]
cmp esi, ecx
jne 0x40655f
mov esi, dword [ecx]
mov eax, dword [esi]
mov dword [0x441ed4], eax
cmp esi, ecx
je 0x4065b4
cmp esi, ebx
je 0x4065b4
mov eax, dword [esi + 8]
test eax, eax
je 0x40657e
push eax
call fcn.0041f3e5
add esp, 4
mov ecx, dword [esi + 4]
mov eax, dword [esi]
push esi
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
call fcn.0041f3e5
mov edx, dword [0x441ec8]
add esp, 4
mov eax, dword [0x441ed4]
dec edx
mov ebx, dword [0x441ecc]
mov ecx, dword [0x441ed0]
mov dword [0x441ec8], edx
test edx, edx
jne 0x4065bf
xor eax, eax
mov word [edi], ax
jmp 0x4065f1
cmp dword [eax + 4], ecx
je 0x4065c8
cmp eax, ecx
jne 0x4065ca
mov eax, ebx
mov eax, dword [eax + 4]
mov dword [0x441ed4], eax
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x4065f1
mov edx, edi
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4065e0
mov ebx, edi
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x4065f6
sub ebx, ecx
push edi
sar ebx, 1
push 0x436c10
mov esi, ebx
mov dword [esp + 0x2c], ebx
push 0x44a060
mov dword [esp + 0x2c], esi
call fcn.0041cbe0
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
movzx edi, word [esp + 0xb8]
movzx edx, word [esp + 0xba]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edx
jmp 0x40649a
test esi, esi
jle 0x40731f
test ebx, ebx
jle 0x40731f
cmp esi, ebx
jne 0x406783
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov word [eax + esi*2 - 2], cx
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
cmp word [esp + 0xb8], 0
je 0x4066bd
push 0x437024
push 0x44a060
call fcn.0041cbe0
dec edi
dec esi
add esp, 8
mov dword [esp + 0x18], edi
dec ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
jmp 0x40731f
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x30]
movzx eax, word [0x44a1d6]
dec ax
mov word [esp + 0x90], ax
mov eax, dword [esp + 0xba]
dec eax
mov word [esp + 0x92], ax
push dword [esp + 0x90]
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x38]
push 1
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x20
push eax
push 0x44a060
call fcn.0041c900
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x30]
movzx eax, word [0x44a1d6]
dec ax
mov word [esp + 0x94], ax
mov eax, dword [esp + 0xba]
dec eax
mov word [esp + 0x96], ax
push dword [esp + 0x94]
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x38]
movzx eax, word [0x44a1d6]
dec esi
dec dword [esp + 0x10]
dec ax
movzx ecx, ax
dec ebx
mov dword [esp + 0x18], ecx
mov edi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
jmp 0x40731f
lea edx, [esi - 1]
lfence
mov dword [esp + 0x24], edx
cmp edx, ebx
jge 0x4067a2
mov eax, dword [esp + 0x14]
mov ecx, ebx
sub ecx, edx
lea edi, [eax + edx*2]
lea esi, [edi + 2]
rep movsw word es:[edi], word [esi]
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call edi
mov esi, dword [esp + 0x2c]
push eax
call esi
lea eax, [esp + 0xcc]
push eax
push 0xfffffffffffffff5
call edi
push eax
call esi
cmp word [esp + 0xb8], 0
je 0x40681a
movzx esi, word [esp + 0xd2]
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x30]
mov eax, dword [esp + 0xb8]
dec eax
mov word [esp + 0x9a], si
mov word [esp + 0x98], ax
push dword [esp + 0x98]
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x38]
mov esi, dword [esp + 0x28]
jmp 0x406841
mov ax, word [0x44a1d6]
dec ax
mov word [esp + 0x50], ax
mov eax, dword [esp + 0xd2]
dec eax
mov word [esp + 0x52], ax
push dword [esp + 0x50]
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x38]
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call edi
push eax
call esi
mov si, word [esp + 0xba]
mov edx, dword [esp + 0x14]
mov di, word [esp + 0xb8]
sub edx, 2
movzx eax, si
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
movzx ecx, di
mov dword [esp + 0x18], ecx
lea eax, [edx + eax*2]
push eax
push 0x43702c
push 0x44a060
call fcn.0041cbe0
add esp, 0xc
mov word [esp + 0x54], di
mov word [esp + 0x56], si
push dword [esp + 0x54]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
mov esi, dword [esp + 0x24]
dec ebx
mov edi, dword [esp + 0x18]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
jmp 0x40731f
xor dword [0x43b038], 1
mov ecx, 0xa
mov eax, 0x63
mov dword [esp + 0xa0], 1
cmovne eax, ecx
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x9c]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x50]
jmp 0x40731f
cmp esi, ebx
je 0x40731f
test ebx, ebx
jle 0x40731f
cmp esi, ebx
jge 0x40692b
mov edi, dword [esp + 0x14]
lea ecx, [esi + esi]
add edi, ecx
mov dword [esp + 0x34], ecx
mov ecx, ebx
sub ecx, dword [esp + 0x20]
lea esi, [edi + 2]
rep movsw word es:[edi], word [esi]
jmp 0x406932
lea eax, [esi + esi]
mov dword [esp + 0x34], eax
lea eax, [esp + 0xb4]
dec ebx
push eax
push 0xfffffffffffffff5
mov dword [esp + 0x2c], ebx
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
mov si, word [esp + 0xba]
mov di, word [esp + 0xb8]
movzx eax, si
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x34]
push eax
movzx ecx, di
push 0x43702c
push 0x44a060
mov dword [esp + 0x24], ecx
call fcn.0041cbe0
add esp, 0xc
mov word [esp + 0x58], di
mov word [esp + 0x5a], si
push dword [esp + 0x58]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
jmp 0x40731f
test esi, esi
je 0x40731f
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov word [esp + 0x5c], di
mov word [esp + 0x5e], si
push dword [esp + 0x5c]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
movzx ecx, si
xor esi, esi
movzx edi, di
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], esi
jmp 0x407323
cmp esi, ebx
je 0x40731f
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x1c]
mov word [esp + 0x60], ax
mov eax, dword [esp + 0x2c]
mov word [esp + 0x62], ax
push dword [esp + 0x60]
push 0xfffffffffffffff5
call esi
push eax
call dword [esp + 0x38]
push dword [esp + 0x14]
push 0x436c10
push 0x44a060
call fcn.0041cbe0
add esp, 0xc
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call esi
push eax
call dword [esp + 0x30]
movzx edi, word [esp + 0xb8]
mov esi, ebx
movzx ecx, word [esp + 0xba]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], esi
jmp 0x407323
mov edx, dword [esp + 0xf4]
mov edi, dword [esp + 0x14]
mov ecx, edi
movzx eax, bx
mov dword [esp + 0x18], eax
xor eax, eax
shr edx, 4
mov word [esp + 0x110], ax
not edx
lea eax, [esp + 0x110]
and edx, 1
push esi
push eax
call fcn.0040dc80
push dword [esp + 0x34]
mov ecx, edi
push dword [esp + 0x44]
call fcn.00406150
lea ecx, [esp + 0x120]
mov edx, edi
mov eax, ecx
add esp, 0x10
sub edx, eax
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x406ab3
mov ebx, edi
lea ecx, [ebx + 2]
nop dword [eax + eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x406ad0
mov eax, dword [esp + 0x38]
sub ebx, ecx
mov word [esp + 0x64], ax
mov eax, dword [esp + 0x2c]
mov word [esp + 0x66], ax
push dword [esp + 0x64]
sar ebx, 1
mov esi, ebx
mov dword [esp + 0x28], ebx
push 0xfffffffffffffff5
mov dword [esp + 0x28], esi
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
push edi
push 0x436c10
push 0x44a060
call fcn.0041cbe0
mov eax, dword [esp + 0x24]
add esp, 0xc
movsx edi, ax
cmp edi, ebx
jle 0x406b90
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
sub edi, ebx
je 0x406b5e
nop
push 1
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x20
push eax
push 0x44a060
call fcn.0041c900
sub edi, 1
jne 0x406b40
movzx eax, word [esp + 0xb8]
mov word [esp + 0x68], ax
movzx eax, word [esp + 0xba]
mov word [esp + 0x6a], ax
push dword [esp + 0x68]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
mov ecx, dword [esp + 0x6c]
movsx eax, cx
jmp 0x406bcd
mov eax, dword [esp + 0x38]
movsx ecx, word [0x44a1d6]
cwde
mov dword [esp + 0x18], eax
add eax, ebx
cdq
idiv ecx
mov ecx, dword [esp + 0x2c]
mov di, word [0x44a1d4]
movsx edx, cx
movsx ecx, di
add edx, eax
dec ecx
cmp edx, ecx
jle 0x406bc9
sub di, ax
dec di
movzx eax, di
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
movsx ecx, word [0x44a1d6]
add eax, ebx
cdq
idiv ecx
add eax, dword [esp + 0x2c]
mov word [esp + 0x70], dx
mov word [esp + 0x72], ax
push dword [esp + 0x70]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
movzx edi, word [esp + 0xb8]
movzx ecx, word [esp + 0xba]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ecx
jmp 0x407323
test byte [esp + 0xf4], 0xc
je case.0x4064bd.10
cmp dword [0x43bbe4], 0
je 0x40731f
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x2c]
mov word [esp + 0x74], si
mov word [esp + 0x76], bx
push dword [esp + 0x74]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
push dword [esp + 0x14]
push 0x436c10
push 0x44a060
call fcn.0041cbe0
mov eax, dword [esp + 0x20]
xor ecx, ecx
movzx edi, si
add esp, 0xc
mov dword [esp + 0x18], edi
mov dword [esp + 0x40], 1
mov word [eax], cx
movzx ecx, bx
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
jmp 0x407327
mov eax, dword [esp + 0x14]
cmp word [eax], 0
je 0x406cbf
mov edx, eax
xor ecx, ecx
call fcn.004101a0
mov eax, dword [esp + 0x14]
mov ecx, 0xa
mov dword [esp + 0x40], 0xa
mov word [eax + ebx*2], cx
inc ebx
xor ecx, ecx
mov dword [esp + 0x24], ebx
push 1
mov word [eax + ebx*2], cx
lea eax, [esp + 0x44]
push eax
push 0x44a060
call fcn.0041c900
mov dword [esp + 0x40], 1
jmp 0x40731f
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
push ebx
push esi
call fcn.00406150
movzx ecx, bx
add esp, 8
movzx edi, si
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
jmp 0x407323
mov eax, dword [0x441ecc]
mov dword [0x441ed4], eax
push dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
mov ecx, edi
push dword [esp + 0x3c]
call fcn.00406150
add esp, 8
cmp dword [0x441ec8], 0
jne 0x406d5e
xor eax, eax
mov word [edi], ax
jmp 0x406da1
mov eax, dword [0x441ed4]
mov ecx, dword [0x441ed0]
cmp dword [eax + 4], ecx
je 0x406d72
cmp eax, ecx
jne 0x406d77
mov eax, dword [0x441ecc]
mov eax, dword [eax + 4]
mov dword [0x441ed4], eax
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x406da1
mov edx, edi
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x406d90
mov ebx, edi
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x406da6
mov eax, dword [esp + 0x38]
sub ebx, ecx
movsx ecx, word [0x44a1d6]
sar ebx, 1
cwde
mov esi, ebx
add eax, ebx
mov dword [esp + 0x24], ebx
cdq
idiv ecx
mov ecx, dword [esp + 0x2c]
movsx edx, cx
add edx, eax
mov dword [esp + 0x18], eax
mov ax, word [0x44a1d4]
movsx ecx, ax
dec ecx
mov dword [esp + 0x20], esi
cmp edx, ecx
jle 0x406df9
sub ax, word [esp + 0x18]
dec ax
movzx eax, ax
mov dword [esp + 0x2c], eax
push edi
push 0x436c10
push 0x44a060
call fcn.0041cbe0
add esp, 0xc
jmp 0x406bf6
push dword [esp + 0x2c]
mov edi, dword [esp + 0x18]
mov ecx, edi
push dword [esp + 0x3c]
call fcn.00406150
add esp, 8
cmp dword [0x441ec8], 0
jne 0x406e37
xor eax, eax
mov word [edi], ax
jmp 0x406e71
mov eax, dword [0x441ed4]
mov ecx, dword [0x441ecc]
cmp dword [eax], ecx
je 0x406e4a
cmp eax, ecx
jne 0x406e4f
mov eax, dword [0x441ed0]
mov eax, dword [eax]
mov dword [0x441ed4], eax
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x406e71
mov edx, edi
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x406e60
mov ebx, edi
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x406e76
mov eax, dword [esp + 0x38]
sub ebx, ecx
movsx ecx, word [0x44a1d6]
sar ebx, 1
cwde
mov esi, ebx
add eax, ebx
mov dword [esp + 0x24], ebx
cdq
idiv ecx
mov ecx, dword [esp + 0x2c]
movsx edx, cx
add edx, eax
mov dword [esp + 0x18], eax
mov ax, word [0x44a1d4]
movsx ecx, ax
dec ecx
mov dword [esp + 0x20], esi
cmp edx, ecx
jle 0x406df9
sub ax, word [esp + 0x18]
jmp 0x406df0
test cl, 0xc
je 0x406fac
test esi, esi
jle 0x40731f
mov eax, dword [esp + 0x14]
lea eax, [eax + esi*2]
add eax, 0xfffffffe
cmp word [eax], 0x20
movzx ecx, di
mov dword [esp + 0x10], ecx
jne 0x406f37
dec esi
sub eax, 2
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], eax
test di, di
jne 0x406f0f
mov ax, word [0x44a1d6]
dec ax
movzx edi, ax
jmp 0x406f10
dec edi
cmp word [esp + 0x10], 0
lea eax, [edx - 1]
movzx ecx, ax
movzx eax, dx
cmovne ecx, eax
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x34]
movzx edx, cx
mov dword [esp + 0x10], edx
test esi, esi
jg 0x406ee4
jmp 0x406f8e
mov ebx, dword [esp + 0x14]
add ebx, 0xfffffffe
lea ebx, [ebx + esi*2]
cmp word [ebx], 0x20
movzx eax, di
mov dword [esp + 0x20], eax
je 0x406f7e
dec esi
sub ebx, 2
test di, di
jne 0x406f64
mov ax, word [0x44a1d6]
dec ax
movzx edi, ax
jmp 0x406f65
dec edi
cmp word [esp + 0x20], 0
lea eax, [edx - 1]
movzx ecx, ax
movzx eax, dx
cmovne ecx, eax
movzx edx, cx
test esi, esi
jg 0x406f41
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], esi
mov word [esp + 0x7a], dx
mov word [esp + 0x78], di
push dword [esp + 0x78]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
jmp 0x40731f
test esi, esi
jle 0x407098
lea eax, [esp + 0xcc]
dec esi
push eax
push 0xfffffffffffffff5
mov dword [esp + 0x28], esi
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
cmp word [esp + 0xd0], 0
jne 0x407032
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x30]
movzx eax, word [0x44a1d6]
dec ax
mov word [esp + 0x7c], ax
mov eax, dword [esp + 0xba]
dec eax
mov word [esp + 0x7e], ax
push dword [esp + 0x7c]
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x38]
movzx eax, word [0x44a1d6]
mov ecx, dword [esp + 0x10]
dec ax
movzx edi, ax
dec ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ecx
jmp 0x407323
lea eax, [esp + 0xcc]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
movzx esi, word [esp + 0xd2]
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
mov eax, dword [esp + 0xb8]
dec eax
mov word [esp + 0x82], si
mov word [esp + 0x80], ax
push dword [esp + 0x80]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
mov esi, dword [esp + 0x20]
dec edi
mov dword [esp + 0x18], edi
jmp 0x40731f
push 0xffffffffffffffff
call dword [esp + 0xb4]
jmp 0x40731f
test cl, 0xc
je 0x40719b
cmp esi, ebx
je 0x40731f
nop word [eax + eax]
mov eax, dword [esp + 0x14]
cmp word [eax + esi*2], 0x20
je 0x407116
mov ax, word [0x44a1d6]
inc esi
cwde
xor ecx, ecx
movsx edx, di
mov dword [esp + 0x20], esi
lea esi, [eax - 1]
cmp edx, esi
lea eax, [edi + 1]
movzx eax, ax
cmovne ecx, eax
mov eax, dword [esp + 0x10]
inc eax
movzx edi, cx
movzx ecx, ax
cmp edx, esi
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
movzx eax, ax
cmovne ecx, eax
mov dword [esp + 0x18], edi
movzx edx, cx
mov dword [esp + 0x10], edx
cmp esi, ebx
jne 0x4070c0
jmp 0x407174
cmp esi, ebx
je 0x407174
nop word [eax + eax]
cmp word [eax + esi*2], 0x20
jne 0x407170
mov ax, word [0x44a1d6]
inc esi
cwde
xor ecx, ecx
movsx edx, di
mov dword [esp + 0x20], esi
lea esi, [eax - 1]
cmp edx, esi
lea eax, [edi + 1]
movzx eax, ax
cmovne ecx, eax
mov eax, dword [esp + 0x10]
inc eax
movzx edi, cx
movzx ecx, ax
cmp edx, esi
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
movzx eax, ax
cmovne ecx, eax
mov eax, dword [esp + 0x14]
movzx edx, cx
mov dword [esp + 0x10], edx
cmp esi, ebx
jne 0x407120
mov dword [esp + 0x18], edi
mov word [esp + 0x86], dx
mov word [esp + 0x84], di
push dword [esp + 0x84]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
jmp 0x40731f
cmp esi, ebx
je 0x407288
lea eax, [esp + 0xcc]
inc esi
push eax
push 0xfffffffffffffff5
mov dword [esp + 0x28], esi
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
movsx ecx, word [0x44a1d6]
movsx eax, word [esp + 0xd0]
dec ecx
cmp eax, ecx
jne 0x407222
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x30]
xor eax, eax
mov word [esp + 0x88], ax
mov eax, dword [esp + 0xba]
inc eax
mov word [esp + 0x8a], ax
push dword [esp + 0x88]
push 0xfffffffffffffff5
call edi
push eax
call dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
xor edi, edi
inc ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ecx
jmp 0x407323
lea eax, [esp + 0xcc]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
movzx esi, word [esp + 0xd2]
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
mov eax, dword [esp + 0xb8]
inc eax
mov word [esp + 0x8e], si
mov word [esp + 0x8c], ax
push dword [esp + 0x8c]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
mov esi, dword [esp + 0x20]
inc edi
mov dword [esp + 0x18], edi
jmp 0x40731f
call fcn.00410180
mov edx, eax
test edx, edx
je 0x40731f
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x34], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4072a0
sub ecx, dword [esp + 0x34]
sar ecx, 1
cmp ebx, ecx
jge 0x40731f
movzx esi, word [edx + esi*2]
mov eax, esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push 1
push eax
push 0x44a060
call fcn.0041c900
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
movzx edi, word [esp + 0xb8]
movzx ecx, word [esp + 0xba]
mov dword [esp + 0x18], edi
mov word [edx + eax*2], si
mov esi, eax
inc esi
mov dword [esp + 0x10], ecx
inc ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
mov eax, edx
jmp 0x407327
mov dword [esp + 0x3c], 1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dx, word [esp + 0xf2]
mov word [esp + 0x34], dx
cmp dx, 0x20
jb 0x407570
cmp ebx, 0x1ffd
je 0x407570
cmp dword [esp + 0x3c], 0
je 0x407570
cmp dword [0x43b038], 0
je 0x40749d
cmp esi, ebx
je 0x4074a1
lea eax, [eax + esi*2]
mov edx, eax
mov dword [esp + 0x4c], eax
lea eax, [edx + 2]
mov dword [esp + 0x3c], eax
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x407380
sub edx, dword [esp + 0x3c]
movsx eax, word [0x44a1d6]
sar edx, 1
mov dword [esp + 0x3c], eax
lea eax, [edx + edi]
movsx edx, ax
movsx eax, word [0x44a1d6]
dec eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov eax, edx
cdq
idiv dword [esp + 0x3c]
cmp edx, dword [esp + 0x24]
jne 0x4073e8
mov eax, dword [esp + 0x20]
cdq
idiv dword [esp + 0x3c]
movsx ecx, cx
add eax, ecx
movsx ecx, word [0x44a1d4]
dec ecx
cmp eax, ecx
mov ecx, dword [esp + 0x10]
jne 0x4073ec
dec dword [esp + 0x2c]
dec ecx
mov dword [esp + 0x10], ecx
jmp 0x4073ec
mov ecx, dword [esp + 0x10]
mov eax, ebx
mov dword [esp + 0x3c], eax
cmp eax, esi
jle 0x407412
mov edx, dword [esp + 0x14]
mov edi, ebx
nop dword [eax]
mov ax, word [edx + edi*2 - 2]
mov word [edx + edi*2], ax
dec edi
cmp edi, esi
jg 0x407400
mov edi, dword [esp + 0x18]
mov edx, dword [esp + 0x4c]
inc esi
mov ax, word [esp + 0x34]
mov dword [esp + 0x20], esi
mov word [edx], ax
lea eax, [ecx + 1]
movzx ecx, ax
mov eax, dword [esp + 0x10]
movsx edx, di
cmp edx, dword [esp + 0x24]
movzx eax, ax
cmovne ecx, eax
mov eax, dword [esp + 0x18]
movzx edi, cx
inc eax
xor ecx, ecx
movzx eax, ax
cmp edx, dword [esp + 0x24]
cmovne ecx, eax
mov eax, dword [esp + 0x20]
movzx esi, cx
mov ecx, dword [esp + 0x14]
sub ecx, 2
lea eax, [ecx + eax*2]
push eax
push 0x436c10
push 0x44a060
call fcn.0041cbe0
add esp, 0xc
mov word [esp + 0x44], si
mov word [esp + 0x46], di
push dword [esp + 0x44]
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x38]
inc ebx
mov ecx, esi
mov dword [esp + 0x24], ebx
mov eax, edi
mov dword [esp + 0x18], ecx
jmp 0x40756c
cmp esi, ebx
jne 0x4074a6
inc ebx
mov dword [esp + 0x24], ebx
mov cx, word [esp + 0x34]
mov word [eax + esi*2], cx
lea eax, [esp + 0xcc]
inc esi
push eax
mov dword [esp + 0x24], esi
mov esi, dword [esp + 0x20]
push 0xfffffffffffffff5
call esi
mov edi, dword [esp + 0x2c]
push eax
call edi
movsx ecx, word [0x44a1d6]
movsx eax, word [esp + 0xd0]
dec ecx
cmp eax, ecx
jne 0x40750a
lea eax, [esp + 0xb4]
push eax
push 0xfffffffffffffff5
call esi
push eax
call edi
movsx ecx, word [0x44a1d4]
movsx eax, word [esp + 0xba]
dec ecx
cmp eax, ecx
jne 0x40750a
dec dword [esp + 0x2c]
dec dword [esp + 0x10]
lea eax, [esp + 0xcc]
push eax
push 0xfffffffffffffff5
call esi
push eax
call edi
movzx eax, word [esp + 0x34]
movsx edi, word [0x44a1d6]
movsx esi, word [esp + 0xd0]
dec edi
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x4c]
push 1
push eax
push 0x44a060
call fcn.0041c900
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov edx, dword [esp + 0x10]
inc eax
movzx eax, ax
cmp esi, edi
cmovne ecx, eax
movzx ecx, cx
lea eax, [edx + 1]
mov dword [esp + 0x18], ecx
movzx ecx, ax
movzx eax, dx
cmovne ecx, eax
movzx eax, cx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x40], 0
je 0x4063c0
cmp dword [0x43b038], 0
mov ecx, 0xa
mov eax, 0x63
mov dword [esp + 0xa0], 1
cmovne eax, ecx
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x9c]
push eax
push 0xfffffffffffffff5
call dword [esp + 0x24]
push eax
call dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
call fcn.00401000
mov ecx, dword [esp + 0x31c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041d22b
mov esp, ebp
pop ebp
ret