Function at 0x4080f0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Contain obfuscated stackstrings
Get ntdll base address
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x41bfae
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0xdb8624]
xor eax, esp
mov dword [esp + 0x154], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0xdb8624]
xor eax, esp
push eax
lea eax, [esp + 0x16c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x17c]
lea eax, [esp + 0x14]
mov esi, ecx
push eax
mov ecx, edi
mov dword [esp + 0x7c], edi
call dword [0x41f2b8]
mov ecx, dword [eax]
cmp dword [ecx + 4], 0
lea ecx, [esp + 0x14]
sete byte [esp + 0x1b]
call dword [0x41f508]
mov ebp, dword [0x41f2b4]
or ebx, 0xffffffff
cmp byte [esp + 0x1b], 0
je 0x408199
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1f]
call fcn.00407430
push eax
mov ecx, edi
mov dword [esp + 0x178], 0
call ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x174], ebx
call dword [0x41f508]
push 2
mov ecx, edi
call dword [0x41fbe4]
lea eax, [esp + 0x38]
push eax
mov ecx, edi
mov dword [esp + 0x3c], 0x4e4
mov dword [esp + 0x40], 0x2f0
call dword [0x41fbe8]
lea ecx, [esp + 0xc0]
call dword [0x41f55c]
push 6
lea ecx, [esp + 0xc4]
mov dword [esp + 0x178], 1
call dword [0x41f558]
lea ecx, [esp + 0xc0]
push ecx
mov ecx, edi
call dword [0x41fbec]
push 1
push 2
mov ecx, edi
call dword [0x41fbf0]
push 0
mov ecx, edi
call dword [0x41fbf4]
lea ecx, [esp + 0x70]
call dword [0x41f554]
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x1f]
call fcn.00407450
push 1
push 0
lea ecx, [esp + 0x24]
push ecx
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0x184], 3
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call dword [0x41f550]
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 2
call dword [0x41f508]
lea edx, [esp + 0x70]
push edx
mov ecx, edi
call dword [0x41fbf8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1f]
call fcn.00407470
push eax
mov ecx, edi
mov byte [esp + 0x178], 4
call dword [0x41fc00]
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 2
call dword [0x41f508]
push 1
mov ecx, edi
call dword [0x41fa44]
push 0x18
call fcn.00419d10
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x174], 5
test ebx, ebx
je 0x4082e9
push ecx
mov eax, esp
mov dword [esp + 0x3c], esp
push edi
mov ecx, ebx
mov dword [eax], 0
call dword [0x41fb08]
mov dword [ebx], 0x422cac
mov dword [ebx + 8], 0x422c88
mov edi, ebx
jmp 0x4082eb
xor edi, edi
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1f]
mov dword [esi], edi
call fcn.00407490
push eax
mov ecx, edi
mov byte [esp + 0x178], 6
call ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 2
call dword [0x41f508]
push 1
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], 0
call dword [0x41fb0c]
push 0
lea ecx, [esp + 0x38]
call dword [0x41fb10]
push 0
lea ecx, [esp + 0x38]
call dword [0x41fb14]
mov ecx, dword [esi]
lea edx, [esp + 0x1c]
push edx
call dword [0x41fb18]
mov eax, dword [eax]
shr eax, 0x1d
and al, 1
movzx ecx, al
mov eax, dword [esp + 0x34]
shl ecx, 0x1d
xor ecx, eax
and ecx, 0x20000000
xor eax, ecx
mov ecx, dword [esi]
push eax
mov dword [esp + 0x38], eax
call dword [0x41fb1c]
mov ecx, 0x422c08
push ecx
mov eax, 0x7b
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x178], 7
call dword [0x41fc00]
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 2
call dword [0x41f508]
push 0x18
call fcn.00419d10
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
mov byte [esp + 0x174], 8
test edi, edi
je 0x4083fb
push ecx
mov eax, esp
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esp + 0x3c], esp
push eax
mov ecx, edi
call dword [0x41fb20]
mov dword [edi], 0x422b54
mov dword [edi + 8], 0x422b34
jmp 0x4083fd
xor edi, edi
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x1f]
mov dword [esi + 4], edi
call fcn.004074b0
push eax
mov ecx, edi
mov byte [esp + 0x178], 9
call ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 2
call dword [0x41f508]
mov ecx, dword [esi + 4]
mov ebx, dword [0x41fb24]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x258
mov dword [esp + 0x24], 0x1d4
mov dword [esp + 0x28], 0x419
mov dword [esp + 0x2c], 0x1e3
call ebx
lea ecx, [esp + 0x60]
call dword [0x41f54c]
push 0xff
push 0x8f
push 0xcf
push 0xf4
lea ecx, [esp + 0x138]
mov byte [esp + 0x184], 0xa
call dword [0x41f548]
push 1
lea eax, [esp + 0x12c]
push eax
lea ecx, [esp + 0x34]
call dword [0x41f544]
push 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x178], 0xb
call dword [0x41f540]
mov edi, dword [0x41f53c]
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
lea ecx, [esp + 0x6c]
call edi
lea edx, [esp + 0x2c]
push edx
push 6
push 0
lea ecx, [esp + 0x6c]
call edi
lea eax, [esp + 0x2c]
push eax
push 8
push 0
lea ecx, [esp + 0x6c]
call edi
lea ecx, [esp + 0x2c]
push ecx
push 0
push 2
lea ecx, [esp + 0x6c]
call edi
lea edx, [esp + 0x2c]
push edx
push 6
push 2
lea ecx, [esp + 0x6c]
call edi
lea eax, [esp + 0x2c]
push eax
push 8
push 2
lea ecx, [esp + 0x6c]
call edi
lea ecx, [esp + 0x2c]
push ecx
push 0
push 1
lea ecx, [esp + 0x6c]
call edi
lea edx, [esp + 0x2c]
push edx
push 6
push 1
lea ecx, [esp + 0x6c]
call edi
lea eax, [esp + 0x2c]
push eax
push 8
push 1
lea ecx, [esp + 0x6c]
call edi
lea ecx, [esp + 0x60]
push ecx
mov ecx, dword [esi + 4]
call dword [0x41fb28]
lea ecx, [esp + 0xa0]
call dword [0x41f55c]
push 8
lea ecx, [esp + 0xa4]
mov byte [esp + 0x178], 0xc
call dword [0x41f558]
push 0x4b
lea ecx, [esp + 0xa4]
call dword [0x41f538]
push 0x4b
lea ecx, [esp + 0xa4]
call dword [0x41f538]
mov ecx, dword [esi + 4]
lea edx, [esp + 0xa0]
push edx
call dword [0x41fbec]
mov ecx, 0x422ac0
push ecx
mov eax, 0x6f
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0xd
call dword [0x41fc00]
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0xc
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0xe
test eax, eax
je 0x408620
mov ecx, dword [esi]
push ecx
mov ecx, eax
call dword [0x41fb2c]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x4229d4
mov dword [eax + 8], 0x4229b0
mov dword [esp + 0x14], eax
jmp 0x408628
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 8], edx
call fcn.004074d0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0xf
call ebp
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0xc
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 8]
mov dword [esp + 0x20], 0x1e
mov dword [esp + 0x24], 0xdc
mov dword [esp + 0x28], 0x2d
mov dword [esp + 0x2c], 0xeb
call ebx
mov ecx, dword [esi + 8]
lea edx, [esp + 0x1c]
push edx
call dword [0x41fb18]
mov eax, dword [eax]
shr eax, 0x1d
and al, 1
movzx ecx, al
mov eax, dword [esp + 0x34]
shl ecx, 0x1d
xor ecx, eax
and ecx, 0x20000000
xor eax, ecx
mov ecx, dword [esi + 8]
push eax
mov dword [esp + 0x38], eax
call dword [0x41fb1c]
lea ecx, [esp + 0x48]
call dword [0x41f54c]
push 0xff
push 0xca
push 0xca
push 0xca
lea ecx, [esp + 0xf8]
mov byte [esp + 0x184], 0x10
call dword [0x41f548]
push 1
lea edx, [esp + 0xec]
push edx
lea ecx, [esp + 0x38]
call dword [0x41f544]
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x178], 0x11
call dword [0x41f540]
lea eax, [esp + 0x30]
push eax
push 0
push 0
lea ecx, [esp + 0x54]
call edi
lea ecx, [esp + 0x30]
push ecx
push 6
push 0
lea ecx, [esp + 0x54]
call edi
lea edx, [esp + 0x30]
push edx
push 7
push 0
lea ecx, [esp + 0x54]
call edi
push 0xff
push 0xc8
push 0xc8
push 0xc8
lea ecx, [esp + 0xd8]
call dword [0x41f548]
push 1
lea eax, [esp + 0xcc]
push eax
lea ecx, [esp + 0x64]
call dword [0x41f544]
push 1
lea ecx, [esp + 0x60]
mov byte [esp + 0x178], 0x12
call dword [0x41f540]
lea ecx, [esp + 0x5c]
push ecx
push 8
push 0
lea ecx, [esp + 0x54]
call edi
push 0xff
push 0
push 0
push 0
lea ecx, [esp + 0x118]
call dword [0x41f548]
push 1
lea edx, [esp + 0x10c]
push edx
lea ecx, [esp + 0x90]
call dword [0x41f544]
push 0
lea ecx, [esp + 0x8c]
mov byte [esp + 0x178], 0x13
call dword [0x41f540]
lea eax, [esp + 0x88]
push eax
push 9
push 0
lea ecx, [esp + 0x54]
call edi
lea ecx, [esp + 0x30]
push ecx
push 0
push 2
lea ecx, [esp + 0x54]
call edi
lea edx, [esp + 0x30]
push edx
push 6
push 2
lea ecx, [esp + 0x54]
call edi
lea eax, [esp + 0x30]
push eax
push 7
push 2
lea ecx, [esp + 0x54]
call edi
lea ecx, [esp + 0x5c]
push ecx
push 8
push 2
lea ecx, [esp + 0x54]
call edi
push 0xff
push 0
push 0
push 0
lea ecx, [esp + 0x158]
call dword [0x41f548]
push 1
lea edx, [esp + 0x14c]
push edx
lea ecx, [esp + 0x88]
call dword [0x41f544]
push 0
lea ecx, [esp + 0x84]
mov byte [esp + 0x178], 0x14
call dword [0x41f540]
lea eax, [esp + 0x80]
push eax
push 9
push 2
lea ecx, [esp + 0x54]
call edi
push 0xff
push 0x78
push 0x78
push 0x78
lea ecx, [esp + 0xe8]
call dword [0x41f548]
push 1
lea ecx, [esp + 0xdc]
push ecx
lea ecx, [esp + 0x58]
call dword [0x41f544]
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0x178], 0x15
call dword [0x41f540]
lea edx, [esp + 0x50]
push edx
push 0
push 1
lea ecx, [esp + 0x54]
call edi
lea eax, [esp + 0x50]
push eax
push 6
push 1
lea ecx, [esp + 0x54]
call edi
lea ecx, [esp + 0x30]
push ecx
push 7
push 1
lea ecx, [esp + 0x54]
call edi
lea edx, [esp + 0x50]
push edx
push 8
push 1
lea ecx, [esp + 0x54]
call edi
push 0xff
push 0
push 0
push 0
lea ecx, [esp + 0x108]
call dword [0x41f548]
push 1
lea eax, [esp + 0xfc]
push eax
lea ecx, [esp + 0x7c]
call dword [0x41f544]
push 0
lea ecx, [esp + 0x78]
mov byte [esp + 0x178], 0x16
call dword [0x41f540]
lea ecx, [esp + 0x74]
push ecx
push 9
push 1
lea ecx, [esp + 0x54]
call edi
mov ecx, dword [esi + 8]
lea edx, [esp + 0x48]
push edx
call dword [0x41fb28]
lea ecx, [esp + 0xb8]
call dword [0x41f55c]
push 0xa
lea ecx, [esp + 0xbc]
mov byte [esp + 0x178], 0x17
call dword [0x41f558]
mov ecx, dword [esi + 8]
lea eax, [esp + 0xb8]
push eax
call dword [0x41fbec]
mov ecx, dword [esi + 8]
push 0
call dword [0x41fb30]
mov ecx, dword [esi + 8]
push 0
call dword [0x41fb34]
mov ecx, dword [esi + 8]
push 1
call dword [0x41fb38]
mov ecx, dword [esi + 8]
push 1
call dword [0x41fb3c]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x18
test eax, eax
je 0x408a01
mov ecx, dword [esi]
push ecx
mov ecx, eax
call dword [0x41fb2c]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x4229d4
mov dword [eax + 8], 0x4229b0
mov dword [esp + 0x14], eax
jmp 0x408a09
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0xc], edx
call fcn.004074f0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x19
call ebp
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x17
call dword [0x41f508]
mov ecx, 0xa
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x1c]
mov eax, 0xf0
push ecx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
call ebx
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x1c]
push edx
call dword [0x41fb18]
mov eax, dword [eax]
shr eax, 0x1d
and al, 1
movzx ecx, al
mov eax, dword [esp + 0x34]
shl ecx, 0x1d
xor ecx, eax
and ecx, 0x20000000
xor eax, ecx
mov ecx, dword [esi + 0xc]
push eax
mov dword [esp + 0x38], eax
call dword [0x41fb1c]
lea ecx, [esp + 0x54]
call dword [0x41f54c]
lea edx, [esp + 0x30]
push edx
push 0
push 0
lea ecx, [esp + 0x60]
mov byte [esp + 0x180], 0x1a
call edi
lea eax, [esp + 0x30]
push eax
push 6
push 0
lea ecx, [esp + 0x60]
call edi
lea ecx, [esp + 0x30]
push ecx
push 7
push 0
lea ecx, [esp + 0x60]
call edi
lea edx, [esp + 0x5c]
push edx
push 8
push 0
lea ecx, [esp + 0x60]
call edi
push 0xff
push 0
push 0
push 0
lea ecx, [esp + 0x128]
call dword [0x41f548]
push 1
lea eax, [esp + 0x11c]
push eax
lea ecx, [esp + 0x94]
call dword [0x41f544]
push 0
lea ecx, [esp + 0x90]
mov byte [esp + 0x178], 0x1b
call dword [0x41f540]
lea ecx, [esp + 0x8c]
push ecx
push 9
push 0
lea ecx, [esp + 0x60]
call edi
lea edx, [esp + 0x30]
push edx
push 0
push 2
lea ecx, [esp + 0x60]
call edi
lea eax, [esp + 0x30]
push eax
push 6
push 2
lea ecx, [esp + 0x60]
call edi
lea ecx, [esp + 0x30]
push ecx
push 7
push 2
lea ecx, [esp + 0x60]
call edi
lea edx, [esp + 0x5c]
push edx
push 8
push 2
lea ecx, [esp + 0x60]
call edi
push 0xff
push 0
push 0
push 0
lea ecx, [esp + 0x148]
call dword [0x41f548]
push 1
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x84]
call dword [0x41f544]
push 0
lea ecx, [esp + 0x80]
mov byte [esp + 0x178], 0x1c
call dword [0x41f540]
lea ecx, [esp + 0x7c]
push ecx
push 9
push 2
lea ecx, [esp + 0x60]
call edi
lea edx, [esp + 0x50]
push edx
push 0
push 1
lea ecx, [esp + 0x60]
call edi
lea eax, [esp + 0x50]
push eax
push 6
push 1
lea ecx, [esp + 0x60]
call edi
lea ecx, [esp + 0x30]
push ecx
push 7
push 1
lea ecx, [esp + 0x60]
call edi
lea edx, [esp + 0x50]
push edx
push 8
push 1
lea ecx, [esp + 0x60]
call edi
push 0xff
push 0
push 0
push 0
lea ecx, [esp + 0x168]
call dword [0x41f548]
push 1
lea eax, [esp + 0x15c]
push eax
lea ecx, [esp + 0x8c]
call dword [0x41f544]
push 0
lea ecx, [esp + 0x88]
mov byte [esp + 0x178], 0x1d
call dword [0x41f540]
lea ecx, [esp + 0x84]
push ecx
push 9
push 1
lea ecx, [esp + 0x60]
call edi
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x54]
push edx
call dword [0x41fb28]
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0xb8]
push eax
call dword [0x41fbec]
mov ecx, dword [esi + 0xc]
push 0
call dword [0x41fb30]
mov ecx, dword [esi + 0xc]
push 0
call dword [0x41fb34]
mov ecx, dword [esi + 0xc]
push 1
call dword [0x41fb38]
mov ecx, dword [esi + 0xc]
push 1
call dword [0x41fb3c]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x1e
test eax, eax
je 0x408cec
mov ecx, dword [esi]
push ecx
mov ecx, eax
call dword [0x41fb40]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x4228ec
mov dword [eax + 8], 0x4228c8
mov dword [esp + 0x14], eax
jmp 0x408cf4
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x10], edx
call fcn.00407510
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x1f
call ebp
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x1d
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x10]
mov dword [esp + 0x20], 0x2d8
mov dword [esp + 0x24], 0x254
mov dword [esp + 0x28], 0x39f
mov dword [esp + 0x2c], 0x2a3
call ebx
lea ecx, [esp + 0xa8]
call dword [0x41f55c]
push 0xc
lea ecx, [esp + 0xac]
mov byte [esp + 0x178], 0x20
call dword [0x41f558]
push 0x4b
lea ecx, [esp + 0xac]
call dword [0x41f538]
push 0x4b
lea ecx, [esp + 0xac]
call dword [0x41f538]
mov ecx, dword [esi + 0x10]
lea edx, [esp + 0xa8]
push edx
call dword [0x41fbec]
push 0xd
lea ecx, [esp + 0x3c]
call dword [0x41f534]
mov ecx, dword [esi + 0x10]
push eax
mov byte [esp + 0x178], 0x21
call dword [0x41fb44]
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x20
call dword [0x41f530]
mov ecx, 0x4226f0
push ecx
mov eax, 0x1d0
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x10]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x22
call dword [0x41fc00]
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x20
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x23
test eax, eax
je 0x408e60
push ecx
mov eax, esp
mov dword [eax], 0
mov ecx, dword [esi]
mov dword [esp + 0x20], esp
push ecx
mov ecx, dword [esp + 0x1c]
call dword [0x41fb20]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x422b54
mov dword [eax + 8], 0x422b34
mov dword [esp + 0x14], eax
jmp 0x408e68
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x14], edx
call fcn.00407530
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x24
call ebp
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x20
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x20], 0x258
mov dword [esp + 0x24], 0x1c2
mov dword [esp + 0x28], 0x419
mov dword [esp + 0x2c], 0x1d1
call ebx
lea ecx, [esp + 0x68]
call dword [0x41f54c]
lea edx, [esp + 0x2c]
push edx
push 0
push 0
lea ecx, [esp + 0x74]
mov byte [esp + 0x180], 0x25
call edi
lea eax, [esp + 0x2c]
push eax
push 6
push 0
lea ecx, [esp + 0x74]
call edi
lea ecx, [esp + 0x2c]
push ecx
push 8
push 0
lea ecx, [esp + 0x74]
call edi
lea edx, [esp + 0x2c]
push edx
push 0
push 2
lea ecx, [esp + 0x74]
call edi
lea eax, [esp + 0x2c]
push eax
push 6
push 2
lea ecx, [esp + 0x74]
call edi
lea ecx, [esp + 0x2c]
push ecx
push 8
push 2
lea ecx, [esp + 0x74]
call edi
lea edx, [esp + 0x2c]
push edx
push 0
push 1
lea ecx, [esp + 0x74]
call edi
lea eax, [esp + 0x2c]
push eax
push 6
push 1
lea ecx, [esp + 0x74]
call edi
lea ecx, [esp + 0x2c]
push ecx
push 8
push 1
lea ecx, [esp + 0x74]
call edi
lea edx, [esp + 0x68]
mov ecx, dword [esi + 0x14]
push edx
call dword [0x41fb28]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0xa0]
push eax
call dword [0x41fbec]
mov ecx, 0x422ac0
push ecx
mov eax, 0x6f
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x14]
mov byte [esp + 0x178], 0x26
call dword [0x41fc00]
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x25
call dword [0x41f508]
push 0x18
call fcn.00419d10
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
mov byte [esp + 0x174], 0x27
test edi, edi
je 0x408ff4
mov edx, dword [esi]
push edx
mov ecx, edi
call dword [0x41fb40]
mov dword [edi], 0x4228ec
mov dword [edi + 8], 0x4228c8
jmp 0x408ff6
xor edi, edi
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x18], edi
call fcn.00407550
push eax
mov ecx, edi
mov byte [esp + 0x178], 0x28
call ebp
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x25
call dword [0x41f508]
mov ecx, dword [esi + 0x18]
push 1
call dword [0x41fb48]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x20], 0x2da
mov dword [esp + 0x24], 0x104
mov dword [esp + 0x28], 0x34f
mov dword [esp + 0x2c], 0x12b
call ebx
lea ecx, [esp + 0x98]
call dword [0x41f55c]
mov edi, dword [0x41f538]
push 0x4b
lea ecx, [esp + 0x9c]
mov byte [esp + 0x178], 0x29
call edi
push 0x4b
lea ecx, [esp + 0x9c]
call edi
mov ecx, dword [esi + 0x18]
lea edx, [esp + 0x98]
push edx
call dword [0x41fbec]
push 0xd
lea ecx, [esp + 0x3c]
call dword [0x41f534]
mov ecx, dword [esi + 0x18]
push eax
mov byte [esp + 0x178], 0x2a
call dword [0x41fb44]
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x29
call dword [0x41f530]
mov ecx, 0x422518
push ecx
mov eax, 0x1d2
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x18]
mov edi, dword [0x41fc00]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x2b
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x2c
test eax, eax
je 0x409158
push ecx
mov eax, esp
mov dword [eax], 0
mov ecx, dword [esi]
mov dword [esp + 0x20], esp
push ecx
mov ecx, dword [esp + 0x1c]
call dword [0x41fb20]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x422b54
mov dword [eax + 8], 0x422b34
mov dword [esp + 0x14], eax
jmp 0x409160
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x1c], edx
call fcn.00407570
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x2d
call ebp
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x1c]
mov dword [esp + 0x20], 0x1f4
mov dword [esp + 0x24], 0xfffffff6
mov dword [esp + 0x28], 0x2f8
mov dword [esp + 0x2c], 0x6e
call ebx
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x1f]
call fcn.00407590
mov ecx, dword [esi + 0x1c]
push eax
mov byte [esp + 0x178], 0x2e
call edi
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x2f
test eax, eax
je 0x40922c
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
push eax
call dword [0x41fb40]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x4228ec
mov dword [eax + 8], 0x4228c8
mov dword [esp + 0x14], eax
jmp 0x409234
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x38]
mov dword [esi + 0x20], ecx
push edx
lea ecx, [esp + 0x1f]
call fcn.004075b0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x30
call ebp
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
mov ecx, dword [esi + 0x20]
push 1
call dword [0x41fb48]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x3c], 0x41c
mov dword [esp + 0x40], 0x6a
mov dword [esp + 0x44], 0x433
mov dword [esp + 0x48], 0x80
call ebx
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esi + 0x20]
call dword [0x41fbec]
push 0xd
lea ecx, [esp + 0x20]
call dword [0x41f534]
mov ecx, dword [esi + 0x20]
push eax
mov byte [esp + 0x178], 0x31
call dword [0x41fb44]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x29
call dword [0x41f530]
mov ecx, 0x422348
push ecx
mov eax, 0x1c9
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x178], 0x32
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
push 0x1c
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x33
test eax, eax
je 0x409358
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
push eax
call dword [0x41f5f0]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x42228c
mov dword [eax + 8], 0x42226c
mov dword [esp + 0x14], eax
jmp 0x409360
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov dword [esi + 0x24], ecx
push edx
lea ecx, [esp + 0x1f]
call fcn.004075d0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x34
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
mov ecx, dword [esi + 0x24]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x24e
mov dword [esp + 0x24], 0x91
mov dword [esp + 0x28], 0x42e
mov dword [esp + 0x2c], 0x194
call ebx
mov ecx, 0x422238
push ecx
mov eax, 0x2c
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x24]
mov byte [esp + 0x178], 0x35
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1f]
call fcn.004075f0
push 0
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x17c], 0x36
call dword [0x41f46c]
mov ecx, dword [esi + 0x24]
push eax
mov byte [esp + 0x178], 0x37
call dword [0x41f5ec]
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x36
call dword [0x41f468]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x38
test eax, eax
je 0x409491
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
push eax
call dword [0x41fb40]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x4228ec
mov dword [eax + 8], 0x4228c8
mov dword [esp + 0x14], eax
jmp 0x409499
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov dword [esi + 0x28], ecx
push edx
lea ecx, [esp + 0x1f]
call fcn.00407610
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x39
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
mov ecx, dword [esi + 0x28]
push 1
call dword [0x41fb48]
mov ecx, dword [esi + 0x28]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x401
mov dword [esp + 0x24], 0x6a
mov dword [esp + 0x28], 0x418
mov dword [esp + 0x2c], 0x80
call ebx
lea ecx, [esp + 0x98]
push ecx
mov ecx, dword [esi + 0x28]
call dword [0x41fbec]
push 0xd
lea ecx, [esp + 0x3c]
call dword [0x41f534]
mov ecx, dword [esi + 0x28]
push eax
mov byte [esp + 0x178], 0x3a
call dword [0x41fb44]
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x29
call dword [0x41f530]
mov ecx, 0x422070
push ecx
mov eax, 0x1c6
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x28]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x178], 0x3b
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x3c
test eax, eax
je 0x4095bd
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
push eax
call dword [0x41fb40]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x4228ec
mov dword [eax + 8], 0x4228c8
mov dword [esp + 0x14], eax
jmp 0x4095c5
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov dword [esi + 0x2c], ecx
push edx
lea ecx, [esp + 0x1f]
call fcn.00407630
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x3d
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
mov ecx, dword [esi + 0x2c]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x25b
mov dword [esp + 0x24], 0x271
mov dword [esp + 0x28], 0x2e7
mov dword [esp + 0x2c], 0x298
call ebx
push 0xd
lea ecx, [esp + 0x3c]
call dword [0x41f534]
mov ecx, dword [esi + 0x2c]
push eax
mov byte [esp + 0x178], 0x3e
call dword [0x41fb44]
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x29
call dword [0x41f530]
mov ecx, 0x421e78
push ecx
mov eax, 0x1f3
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x2c]
mov byte [esp + 0x178], 0x3f
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x40
test eax, eax
je 0x4096cb
mov edx, dword [esi]
push edx
mov ecx, eax
call dword [0x41fb4c]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421dbc
mov dword [eax + 8], 0x421d98
mov dword [esp + 0x14], eax
jmp 0x4096d3
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f]
mov dword [esi + 0x30], eax
call fcn.00407650
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x41
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
mov ecx, dword [esi + 0x30]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x2bc
mov dword [esp + 0x24], 0x1ff
mov dword [esp + 0x28], 0x42d
mov dword [esp + 0x2c], 0x20e
call ebx
mov ecx, dword [esi + 0x30]
push 0
call dword [0x41fb50]
mov ecx, 0x421c88
push ecx
mov eax, 0x109
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x30]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x42
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
mov ecx, dword [esi + 0x30]
push 0
call dword [0x41fb94]
mov ecx, dword [esi + 0x30]
mov eax, 0x21
push eax
call dword [0x41fb54]
mov ecx, dword [esi + 0x30]
push 1
call dword [0x41fb58]
mov ecx, dword [esi + 0x30]
push 1
call dword [0x41fb5c]
mov ecx, dword [esi + 0x30]
push 0
call dword [0x41fb60]
mov ecx, dword [esi + 0x30]
push 0
call dword [0x41fb64]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x43
test eax, eax
je 0x4097fa
mov ecx, dword [esi]
push ecx
mov ecx, eax
call dword [0x41fb4c]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421dbc
mov dword [eax + 8], 0x421d98
mov dword [esp + 0x14], eax
jmp 0x409802
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x34], edx
call fcn.00407670
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x44
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x29
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x34]
mov dword [esp + 0x20], 0x2bc
mov dword [esp + 0x24], 0x1ea
mov dword [esp + 0x28], 0x42d
mov dword [esp + 0x2c], 0x1f9
call ebx
lea ecx, [esp + 0x90]
call dword [0x41f55c]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1f]
call fcn.00407690
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x178], 0x46
call dword [0x41f52c]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
push 8
lea ecx, [esp + 0x94]
call dword [0x41f558]
push 0x32
lea ecx, [esp + 0x94]
call dword [0x41f538]
push 0
lea ecx, [esp + 0x94]
call dword [0x41f528]
push 9
lea ecx, [esp + 0x94]
call dword [0x41f538]
mov ecx, dword [esi + 0x34]
lea eax, [esp + 0x90]
push eax
call dword [0x41fbec]
mov ecx, dword [esi + 0x34]
push 0
call dword [0x41fb50]
mov ecx, dword [esi + 0x34]
push 0
call dword [0x41fb68]
mov ecx, dword [esi + 0x34]
push 0
call dword [0x41fb6c]
mov ecx, 0x421b80
push ecx
mov eax, 0x107
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x34]
mov byte [esp + 0x178], 0x47
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
mov ecx, dword [esi + 0x34]
push 0
call dword [0x41fb94]
mov eax, 0x81
mov ecx, dword [esi + 0x34]
push eax
call dword [0x41fb54]
mov ecx, dword [esi + 0x34]
push 1
call dword [0x41fb58]
mov ecx, dword [esi + 0x34]
push 1
call dword [0x41fb5c]
mov ecx, dword [esi + 0x34]
push 0
call dword [0x41fb60]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x48
test eax, eax
je 0x4099c0
mov edx, dword [esi]
push edx
mov ecx, eax
call dword [0x41fb70]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421abc
mov dword [eax + 8], 0x421a98
jmp 0x4099c2
xor eax, eax
push 8
mov byte [esp + 0x178], 0x45
mov dword [esi + 0x38], eax
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x49
test eax, eax
je 0x409a06
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x14]
push eax
call dword [0x41fb74]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421a68
mov dword [esp + 0x14], eax
jmp 0x409a0e
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov dword [esi + 0x80], ecx
push edx
lea ecx, [esp + 0x1f]
call fcn.004076b0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x4a
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x80]
push 0xffffffffffffffff
push eax
call dword [0x41fb78]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f]
call fcn.004076d0
mov ecx, dword [esi + 0x38]
push eax
mov byte [esp + 0x178], 0x4b
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
mov ecx, dword [esi + 0x38]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x24e
mov dword [esp + 0x24], 0x212
mov dword [esp + 0x28], 0x2ee
mov dword [esp + 0x2c], 0x230
call ebx
mov ecx, 0x421840
push ecx
mov eax, 0x220
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x38]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x4c
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x4d
test eax, eax
je 0x409b23
mov ecx, dword [esi]
push ecx
mov ecx, eax
call dword [0x41fb70]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421abc
mov dword [eax + 8], 0x421a98
jmp 0x409b25
xor eax, eax
mov ecx, dword [esi + 0x80]
push 0xffffffffffffffff
push eax
mov byte [esp + 0x17c], 0x45
mov dword [esi + 0x3c], eax
call dword [0x41fb78]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1f]
call fcn.004076f0
mov ecx, dword [esi + 0x3c]
push eax
mov byte [esp + 0x178], 0x4e
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
mov ecx, dword [esi + 0x3c]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x2ee
mov dword [esp + 0x24], 0x212
mov dword [esp + 0x28], 0x38e
mov dword [esp + 0x2c], 0x230
call ebx
mov ecx, 0x421840
push ecx
mov eax, 0x220
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x3c]
mov byte [esp + 0x178], 0x4f
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x50
test eax, eax
je 0x409c09
mov edx, dword [esi]
push edx
mov ecx, eax
call dword [0x41fb70]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421abc
mov dword [eax + 8], 0x421a98
jmp 0x409c0b
xor eax, eax
mov ecx, dword [esi + 0x80]
push 0xffffffffffffffff
push eax
mov byte [esp + 0x17c], 0x45
mov dword [esi + 0x40], eax
call dword [0x41fb78]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1f]
call fcn.00407710
mov ecx, dword [esi + 0x40]
push eax
mov byte [esp + 0x178], 0x51
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x40]
mov dword [esp + 0x20], 0x5a
mov dword [esp + 0x24], 0x28
mov dword [esp + 0x28], 0xfa
mov dword [esp + 0x2c], 0x46
call ebx
mov ecx, 0x421618
push ecx
mov eax, 0x220
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x40]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x178], 0x52
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x53
test eax, eax
je 0x409cf5
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
push eax
call dword [0x41fb7c]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421554
mov dword [eax + 8], 0x421534
mov dword [esp + 0x14], eax
jmp 0x409cfd
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov dword [esi + 0x44], ecx
push edx
lea ecx, [esp + 0x1f]
call fcn.00407730
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x54
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
mov ecx, dword [esi + 0x44]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0xaa
mov dword [esp + 0x24], 0x1ae
mov dword [esp + 0x28], 0x17c
mov dword [esp + 0x2c], 0x1c6
call ebx
mov ecx, 0x4213e8
push ecx
mov eax, 0x147
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x44]
mov byte [esp + 0x178], 0x55
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
mov ecx, dword [esi + 0x44]
push 1
call dword [0x41fb98]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x56
test eax, eax
je 0x409dde
mov edx, dword [esi]
push edx
mov ecx, eax
call dword [0x41fb7c]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421554
mov dword [eax + 8], 0x421534
mov dword [esp + 0x14], eax
jmp 0x409de6
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f]
mov dword [esi + 0x48], eax
call fcn.00407750
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x57
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
mov ecx, dword [esi + 0x48]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x154
mov dword [esp + 0x24], 0x1ae
mov dword [esp + 0x28], 0x226
mov dword [esp + 0x2c], 0x1c6
call ebx
mov ecx, 0x421298
push ecx
mov eax, 0x148
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x48]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x58
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x59
test eax, eax
je 0x409ebc
mov ecx, dword [esi]
push ecx
mov ecx, eax
call dword [0x41fb40]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x4228ec
mov dword [eax + 8], 0x4228c8
mov dword [esp + 0x14], eax
jmp 0x409ec4
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x4c], edx
call fcn.00407770
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x5a
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x45
call dword [0x41f508]
mov ecx, dword [esi + 0x4c]
push 1
call dword [0x41fb48]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x4c]
mov dword [esp + 0x20], 0x393
mov dword [esp + 0x24], 0x271
mov dword [esp + 0x28], 0x41f
mov dword [esp + 0x2c], 0x298
call ebx
lea ecx, [esp + 0xb0]
call dword [0x41f55c]
push 0x32
lea ecx, [esp + 0xb4]
mov byte [esp + 0x178], 0x5b
call dword [0x41f538]
push 0x32
lea ecx, [esp + 0xb4]
call dword [0x41f538]
mov ecx, dword [esi + 0x4c]
lea edx, [esp + 0xb0]
push edx
call dword [0x41fbec]
push 0xd
lea ecx, [esp + 0x3c]
call dword [0x41f534]
mov ecx, dword [esi + 0x4c]
push eax
mov byte [esp + 0x178], 0x5c
call dword [0x41fb44]
lea ecx, [esp + 0x38]
mov byte [esp + 0x174], 0x5b
call dword [0x41f530]
mov ecx, 0x4210a0
push ecx
mov eax, 0x1f2
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x4c]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x5d
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x5e
test eax, eax
je 0x40a028
push ecx
mov eax, esp
mov dword [eax], 0
mov ecx, dword [esi]
mov dword [esp + 0x20], esp
push ecx
mov ecx, dword [esp + 0x1c]
call dword [0x41fb20]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x422b54
mov dword [eax + 8], 0x422b34
mov dword [esp + 0x14], eax
jmp 0x40a030
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x50], edx
call fcn.00407790
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x5f
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x50]
mov dword [esp + 0x20], 0x276
mov dword [esp + 0x24], 0x19c
mov dword [esp + 0x28], 0x2bc
mov dword [esp + 0x2c], 0x1a5
call ebx
mov ecx, 0x421028
push ecx
mov eax, 0x75
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x50]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x178], 0x60
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x61
test eax, eax
je 0x40a115
push ecx
mov ecx, dword [esp + 0x18]
mov eax, esp
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esp + 0x20], esp
push eax
call dword [0x41fb20]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x422b54
mov dword [eax + 8], 0x422b34
mov dword [esp + 0x14], eax
jmp 0x40a11d
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov dword [esi + 0x54], ecx
push edx
lea ecx, [esp + 0x1f]
call fcn.004077b0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x62
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
mov ecx, dword [esi + 0x54]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x3d4
mov dword [esp + 0x24], 0x19c
mov dword [esp + 0x28], 0x41a
mov dword [esp + 0x2c], 0x1a5
call ebx
mov ecx, 0x420fb0
push ecx
mov eax, 0x75
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x54]
mov byte [esp + 0x178], 0x63
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x64
test eax, eax
je 0x40a1f3
mov edx, dword [esi]
push edx
mov ecx, eax
call dword [0x41fb70]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421abc
mov dword [eax + 8], 0x421a98
mov dword [esp + 0x14], eax
jmp 0x40a1fb
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f]
mov dword [esi + 0x58], eax
call fcn.004077d0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x65
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
mov ecx, dword [esi + 0x58]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x24e
mov dword [esp + 0x24], 0x235
mov dword [esp + 0x28], 0x2ee
mov dword [esp + 0x2c], 0x253
call ebx
mov ecx, 0x421840
push ecx
mov eax, 0x220
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x58]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x66
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x67
test eax, eax
je 0x40a2d1
mov ecx, dword [esi]
push ecx
mov ecx, eax
call dword [0x41fb70]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421abc
mov dword [eax + 8], 0x421a98
mov dword [esp + 0x14], eax
jmp 0x40a2d9
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x5c], edx
call fcn.004077f0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x68
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x20], 0x104
mov dword [esp + 0x24], 0x28
mov dword [esp + 0x28], 0x1a4
mov dword [esp + 0x2c], 0x46
call ebx
mov ecx, 0x421618
push ecx
mov eax, 0x220
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x5c]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x178], 0x69
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x6a
test eax, eax
je 0x40a3be
push ecx
mov ecx, dword [esp + 0x18]
mov eax, esp
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esp + 0x20], esp
push eax
call dword [0x41fb20]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x422b54
mov dword [eax + 8], 0x422b34
mov dword [esp + 0x14], eax
jmp 0x40a3c6
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov dword [esi + 0x60], ecx
push edx
lea ecx, [esp + 0x1f]
call fcn.00407810
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x6b
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
mov ecx, dword [esi + 0x60]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x2a8
mov dword [esp + 0x24], 0x195
mov dword [esp + 0x28], 0x3d4
mov dword [esp + 0x2c], 0x1a9
call ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f]
call fcn.00407830
mov ecx, dword [esi + 0x60]
push eax
mov byte [esp + 0x178], 0x6c
call edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x6d
test eax, eax
je 0x40a49f
push ecx
mov ecx, dword [esp + 0x18]
mov eax, esp
mov dword [eax], 0
mov edx, dword [esi]
mov dword [esp + 0x20], esp
push edx
call dword [0x41fb20]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x422b54
mov dword [eax + 8], 0x422b34
mov dword [esp + 0x14], eax
jmp 0x40a4a7
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f]
mov dword [esi + 0x64], eax
call fcn.00407850
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x6e
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
mov ecx, dword [esi + 0x64]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x276
mov dword [esp + 0x24], 0x1a7
mov dword [esp + 0x28], 0x410
mov dword [esp + 0x2c], 0x1bb
call ebx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1f]
call fcn.00407870
mov ecx, dword [esi + 0x64]
push eax
mov byte [esp + 0x178], 0x6f
call edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x70
test eax, eax
je 0x40a580
push ecx
mov eax, esp
mov dword [eax], 0
mov ecx, dword [esi]
mov dword [esp + 0x20], esp
push ecx
mov ecx, dword [esp + 0x1c]
call dword [0x41fb20]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x422b54
mov dword [eax + 8], 0x422b34
mov dword [esp + 0x14], eax
jmp 0x40a588
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x68], edx
call fcn.00407890
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x71
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x68]
mov dword [esp + 0x20], 0x24e
mov dword [esp + 0x24], 0x96
mov dword [esp + 0x28], 0x42d
mov dword [esp + 0x2c], 0x275
call ebx
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x72
test eax, eax
je 0x40a624
mov edx, dword [esi]
push edx
mov ecx, eax
call dword [0x41fb40]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x4228ec
mov dword [eax + 8], 0x4228c8
mov dword [esp + 0x14], eax
jmp 0x40a62c
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f]
mov dword [esi + 0x6c], eax
call fcn.004078b0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x73
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
mov ecx, dword [esi + 0x6c]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x258
mov dword [esp + 0x24], 0x1ea
mov dword [esp + 0x28], 0x2b4
mov dword [esp + 0x2c], 0x1f9
call ebx
mov ecx, 0x420f20
push ecx
mov eax, 0x8f
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x6c]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x74
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x75
test eax, eax
je 0x40a702
mov ecx, dword [esi]
push ecx
mov ecx, eax
call dword [0x41fb40]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x4228ec
mov dword [eax + 8], 0x4228c8
mov dword [esp + 0x14], eax
jmp 0x40a70a
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1f]
mov dword [esi + 0x70], edx
call fcn.004078d0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x76
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x70]
mov dword [esp + 0x20], 0x258
mov dword [esp + 0x24], 0x1ff
mov dword [esp + 0x28], 0x2b4
mov dword [esp + 0x2c], 0x20e
call ebx
mov ecx, 0x420e88
push ecx
mov eax, 0x90
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x70]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x178], 0x77
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x78
test eax, eax
je 0x40a7ef
push ecx
mov ecx, dword [esp + 0x18]
mov eax, esp
mov dword [eax], 0
mov eax, dword [esi]
mov dword [esp + 0x20], esp
push eax
call dword [0x41fb20]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x422b54
mov dword [eax + 8], 0x422b34
mov dword [esp + 0x14], eax
jmp 0x40a7f7
mov dword [esp + 0x14], 0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
mov dword [esi + 0x74], ecx
push edx
lea ecx, [esp + 0x1f]
call fcn.004078f0
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x79
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
mov ecx, dword [esi + 0x74]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0xb1
mov dword [esp + 0x24], 0x8f
mov dword [esp + 0x28], 0x430
mov dword [esp + 0x2c], 0x299
call ebx
mov ecx, 0x420e4c
push ecx
mov eax, 0x37
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x74]
mov byte [esp + 0x178], 0x7a
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x174], 0x7b
test eax, eax
je 0x40a8cd
mov edx, dword [esi]
push edx
mov ecx, eax
call dword [0x41fb70]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x421abc
mov dword [eax + 8], 0x421a98
mov dword [esp + 0x14], eax
jmp 0x40a8d5
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f]
mov dword [esi + 0x78], eax
call fcn.00407910
mov ecx, dword [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x7c
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
mov ecx, dword [esi + 0x78]
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], 0x38e
mov dword [esp + 0x24], 0x212
mov dword [esp + 0x28], 0x42e
mov dword [esp + 0x2c], 0x230
call ebx
mov ecx, 0x421840
push ecx
mov eax, 0x220
push eax
lea ecx, [esp + 0x1c]
call dword [0x41f2b0]
mov ecx, dword [esi + 0x78]
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x178], 0x7d
call edi
lea ecx, [esp + 0x14]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
push 0x18
call fcn.00419d10
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
mov byte [esp + 0x174], 0x7e
test edi, edi
je 0x40a9a5
mov ecx, dword [esi]
push ecx
mov ecx, edi
call dword [0x41fb80]
mov dword [edi], 0x420d8c
mov dword [edi + 8], 0x420d68
jmp 0x40a9a7
xor edi, edi
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1f]
mov dword [esi + 0x7c], edi
call fcn.00407930
push eax
mov ecx, edi
mov byte [esp + 0x178], 0x7f
call ebp
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
mov ecx, dword [esi + 0x7c]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x2ee
mov dword [esp + 0x24], 0x230
mov dword [esp + 0x28], 0x410
mov dword [esp + 0x2c], 0x24e
call ebx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f]
call fcn.00407950
mov ecx, dword [esi + 0x7c]
push eax
mov byte [esp + 0x178], 0x80
call dword [0x41fc00]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x174], 0x5b
call dword [0x41f508]
mov edx, dword [esi]
mov ecx, dword [esp + 0x78]
push edx
call dword [0x41fb84]
mov ecx, dword [esi + 0x74]
mov edi, dword [0x41fb88]
call edi
mov ecx, dword [esi + 0x10]
call edi
mov ecx, dword [esi + 0x68]
call edi
mov ecx, dword [esi + 4]
call edi
mov ecx, dword [esi + 8]
call edi
mov ecx, dword [esi + 0xc]
call edi
mov ecx, dword [esi + 0x14]
call edi
mov ecx, dword [esi + 0x18]
call edi
mov ecx, dword [esi + 0x1c]
call edi
mov ecx, dword [esi + 0x20]
call edi
mov ecx, dword [esi + 0x28]
call edi
mov ecx, dword [esi + 0x2c]
call edi
mov ecx, dword [esi + 0x30]
call edi
mov ecx, dword [esi + 0x34]
call edi
mov ecx, dword [esi + 0x38]
call edi
mov ecx, dword [esi + 0x3c]
call edi
mov ecx, dword [esi + 0x40]
call edi
mov ecx, dword [esi + 0x44]
call edi
mov ecx, dword [esi + 0x48]
call edi
mov ecx, dword [esi + 0x4c]
call edi
mov ecx, dword [esi + 0x50]
call edi
mov ecx, dword [esi + 0x54]
call edi
mov ecx, dword [esi + 0x24]
call edi
mov ecx, dword [esi + 0x58]
call edi
mov ecx, dword [esi + 0x5c]
call edi
mov ecx, dword [esi + 0x60]
call edi
mov ecx, dword [esi + 0x64]
call edi
mov ecx, dword [esi + 0x6c]
call edi
mov ecx, dword [esi + 0x70]
call edi
mov ecx, dword [esi + 0x78]
call edi
mov ecx, dword [esi + 0x7c]
call edi
mov edi, dword [esp + 0x78]
push edi
mov ecx, esi
call fcn.00405ab0
push edi
call dword [0x41f2ac]
mov edi, dword [0x41f524]
add esp, 4
lea ecx, [esp + 0xb0]
mov byte [esp + 0x174], 0x45
call edi
lea ecx, [esp + 0x90]
mov byte [esp + 0x174], 0x29
call edi
lea ecx, [esp + 0x98]
mov byte [esp + 0x174], 0x25
call edi
mov ebx, dword [0x41f520]
lea ecx, [esp + 0x68]
mov byte [esp + 0x174], 0x20
call ebx
lea ecx, [esp + 0xa8]
mov byte [esp + 0x174], 0x1d
call edi
mov esi, dword [0x41f51c]
lea ecx, [esp + 0x84]
mov byte [esp + 0x174], 0x1c
call esi
lea ecx, [esp + 0x7c]
mov byte [esp + 0x174], 0x1b
call esi
lea ecx, [esp + 0x8c]
mov byte [esp + 0x174], 0x1a
call esi
lea ecx, [esp + 0x54]
mov byte [esp + 0x174], 0x17
call ebx
lea ecx, [esp + 0xb8]
mov byte [esp + 0x174], 0x16
call edi
lea ecx, [esp + 0x74]
mov byte [esp + 0x174], 0x15
call esi
lea ecx, [esp + 0x50]
mov byte [esp + 0x174], 0x14
call esi
lea ecx, [esp + 0x80]
mov byte [esp + 0x174], 0x13
call esi
lea ecx, [esp + 0x88]
mov byte [esp + 0x174], 0x12
call esi
lea ecx, [esp + 0x5c]
mov byte [esp + 0x174], 0x11
call esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x174], 0x10
call esi
lea ecx, [esp + 0x48]
mov byte [esp + 0x174], 0xc
call ebx
mov byte [esp + 0x174], 0xb
lea ecx, [esp + 0xa0]
call edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x174], 0xa
call esi
lea ecx, [esp + 0x60]
mov byte [esp + 0x174], 2
call ebx
lea ecx, [esp + 0x70]
mov byte [esp + 0x174], 1
call dword [0x41f518]
lea ecx, [esp + 0xc0]
mov dword [esp + 0x174], 0xffffffff
call edi
mov ecx, dword [esp + 0x16c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x154]
xor ecx, esp
call fcn.00419cae
add esp, 0x164
ret 4