Function at 0x40e976
Capabilities:
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
and dword [esp + 0x18], 0
push esi
push edi
mov dword [esp + 0x3c], ecx
mov esi, edx
mov dword [esp + 8], 0xe1757117
lea ecx, [esp + 0x1ac]
push 2
mov dword [esp + 0x30], esi
call fcn.00410610
push 1
mov dword [esp + 0x24], 0xbff1eb7e
mov dword [esp + 0x28], 0
pop edi
jmp 0x40e9d0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1ac]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x40e9be
mov dword [esp + 8], 0
jmp 0x40eb62
push 3
lea ecx, [esp + 0x88]
call fcn.00410610
xor eax, eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x24], eax
jmp 0x40ea14
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x84]
mov dword [ecx + edx*4], 0xe1e2c0d3
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x40e9fe
mov ecx, dword [esp + 0x84]
mov dword [ecx], eax
mov dword [esp + 0x14], 0xfffffffa
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], eax
jl 0x40ead2
mov edi, dword [esp + 0x84]
xor edx, edx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x7fc0549e
mov ecx, dword [esp + 0x14]
setge dl
sub edx, 0x4bb489f7
mov dword [esp + 0x28], edx
xor edx, edx
cmp dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
setge dl
mov dword [esp + 0x28], edx
xor edx, edx
cmp dword [esp + 0x28], ecx
push 0
setl dl
xor ecx, ecx
cmp edx, 0x3530
setl cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x20]
cmp edx, dword [ecx]
pop ecx
setl cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x84]
setl dl
cmp edx, dword [edi + 4]
push 0
pop edx
setl dl
add edx, dword [ecx]
mov dword [esp + 0x1c], edx
dec dword [esp + 0x14]
jns 0x40ea41
xor edi, edi
inc edi
mov ecx, dword [esp + 0x84]
inc dword [ecx]
cmp dword [ecx], edi
jle 0x40ea24
mov dword [esp + 0x14], 0x12
jmp 0x40eb4b
push 3
lea ecx, [esp + 0x134]
call fcn.00410610
xor eax, eax
mov dword [esp + 0x24], eax
jmp 0x40eb19
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x130]
mov dword [ecx + edx*4], 7
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x40eb03
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], al
je 0x40eb31
push eax
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0x130]
dec dword [eax + 8]
call fcn.00410a53
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe9
jl 0x40eaed
lea ecx, [esp + 0x84]
call fcn.00410a53
dec dword [esp + 8]
cmp dword [esp + 8], 0xfffffff8
jl 0x40e9e4
lea ecx, [esp + 0x1ac]
call fcn.00410a53
mov eax, dword [0x559a34c]
test al, 1
jne 0x40ec06
or eax, edi
mov dword [0x559a34c], eax
xor eax, eax
push eax
push eax
mov dword [0x559a360], eax
mov dword [0x559a364], eax
call fcn.0041156d
mov ecx, eax
mov dword [0x559a37c], 0x3f800000
mov dword [0x559a360], ecx
xor eax, eax
mov dword [esp + 0xe0], ecx
lea ecx, [esp + 0xe0]
push ecx
push 0x10
push eax
mov dword [0x559a368], eax
mov ecx, 0x559a368
mov dword [0x559a370], eax
mov dword [0x559a36c], eax
lea eax, [esp + 0x190]
push eax
call fcn.00411312
push 0x4a9845
mov dword [0x559a374], 7
mov dword [0x559a378], 8
call fcn.0048e83f
pop ecx
mov dword [esp + 0x1c], 0x1d925b0e
lea ecx, [esp + 0x160]
push edi
call fcn.00410610
mov dword [esp + 0xc], 0
jmp 0x40ec34
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x198], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x40ec25
mov dword [esp + 0xc], 0
jmp 0x40ec5b
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x40ec45
mov eax, dword [esp + 0x19c]
lea ecx, [esp + 0x160]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x160]
mov dword [eax], 9
call fcn.00410a53
imul eax, dword [esp + 0x3c], 0x2710
add eax, esi
mov dword [esp + 0x64], eax
lea eax, [esp + 0x64]
push eax
call fcn.004106d4
mov eax, dword [eax]
test eax, eax
je 0x40eec6
push 2
pop esi
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x148]
mov dword [esp + 0x28], 0x511ecbfc
push esi
mov dword [esp + 0xd8], eax
call fcn.00410610
xor eax, eax
push 3
mov dword [esp + 0x10], eax
pop edi
jmp 0x40ecf0
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xe4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x40ecdd
mov dword [esp + 0xc], eax
jmp 0x40ed12
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x148]
mov dword [ecx + edx*4], 0x5adb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x40ecfc
mov dword [esp + 0xc], edi
jmp 0x40ed30
mov dword [esp + 0x2c], 0x83c8
cmp dword [esp + 0x2c], eax
jne 0x40ed37
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff3
jg 0x40ed1e
mov dword [esp + 0xc], eax
jmp 0x40eeab
mov dword [esp + 8], 0x22e6e7f7
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], eax
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x40ed69
push 0x644
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov dword [esp + 8], eax
cmp dword [esp + 8], esi
jg 0x40eea7
mov edi, dword [esp + 0x148]
mov dword [esp + 0x14], 0x86bdae89
mov dword [esp + 0x10], 0xacdd1f66
mov dword [esp + 0x10], 0xfffffff6
mov ecx, dword [esp + 0xc]
cmp dword [esp + ecx*4 + 0xe4], eax
jne 0x40eda7
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + ecx*4 + 0xe4]
mov ecx, dword [esp + 0xe4]
mov ecx, dword [esp + 8]
cmp dword [esp + 0xc], esi
jne 0x40edcb
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push 0
mov ecx, dword [esp + ecx*4 + 0xe8]
mov ecx, dword [esp + 0x20]
imul edx, dword [esp + 0x20], 0x5e4d
mov ecx, dword [esp + 0xc]
cmp edx, ecx
pop ecx
setl cl
cmp ecx, dword [esp + 0xc]
jg 0x40edf8
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xe8]
cmp dword [esp + 0x28], ecx
je 0x40ee0f
cmp dword [esp + 0x28], eax
jne 0x40ee0f
mov edx, eax
jmp 0x40ee12
xor edx, edx
inc edx
xor ecx, ecx
cmp edx, 0x38d6
setl cl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0x14]
cmp dword [edi + 4], eax
je 0x40ee3c
cmp dword [esp + 0x14], eax
je 0x40ee3c
xor esi, esi
inc esi
jmp 0x40ee3e
mov esi, eax
mov dword [esp + 0x10], 0xaca6
xor edx, edx
mov ecx, dword [esp + 0x10]
cmp ecx, 0xeef1
mov ecx, dword [esp + 8]
setg dl
cmp edx, ecx
push 0
pop edx
setl dl
xor ecx, ecx
cmp esi, 0x737b
push 4
setle cl
sub ecx, edx
sub ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
pop edx
cmp edx, ecx
push 2
sbb ecx, ecx
inc ecx
add ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], 0xfffffffe
inc dword [esp + 0xc]
pop esi
cmp dword [esp + 8], esi
jle 0x40ed7e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x40ed40
lea ecx, [esp + 0x148]
call fcn.00410a53
jmp 0x4104a1
mov dword [esp + 0x14], 0xfffffff8
mov dword [esp + 0x1c], 0xa5d732ad
mov dword [esp + 0x14], 0xfffffff7
jmp 0x40ef4c
mov dword [esp + 8], 0x70cd
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x28], 0x7e6aa165
mov eax, dword [esp + 0x1c]
cmp dword [esp + 8], eax
jne 0x40ef42
mov eax, dword [esp + 8]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], 0
je 0x40ef23
mov eax, dword [esp + 8]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x14], 0x6b5b
jg 0x40ef27
mov eax, dword [esp + 8]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 8]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 8]
cmp dword [esp + 0x14], 0xffffffff
jg 0x40ef42
xor eax, eax
jmp 0x40ef44
mov eax, edi
mov dword [esp + 0x1c], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1b
jg 0x40eee0
xor eax, eax
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], al
je 0x40ef68
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
mov ecx, dword [0x559a34c]
push 2
pop esi
test cl, 2
jne 0x40eff5
push eax
or ecx, esi
mov dword [0x559a390], eax
push eax
mov dword [0x559a34c], ecx
mov dword [0x559a394], eax
call fcn.0041156d
mov ecx, eax
mov dword [0x559a3ac], 0x3f800000
mov dword [0x559a390], ecx
xor eax, eax
mov dword [esp + 0xf4], ecx
lea ecx, [esp + 0xf4]
push ecx
push 0x10
push eax
mov dword [0x559a398], eax
mov ecx, 0x559a398
mov dword [0x559a3a0], eax
mov dword [0x559a39c], eax
lea eax, [esp + 0xfc]
push eax
call fcn.00411312
push 0x4a9840
mov dword [0x559a3a4], 7
mov dword [0x559a3a8], 8
call fcn.0048e83f
pop ecx
mov dword [esp + 0x10], 9
lea ecx, [esp + 0x78]
push edi
call fcn.00410610
xor eax, eax
mov dword [esp + 8], eax
jmp 0x40f01e
mov ecx, dword [esp + 8]
mov dword [esp + ecx*4 + 0x90], edi
inc dword [esp + 8]
cmp dword [esp + 8], 3
jl 0x40f00f
mov dword [esp + 8], eax
jmp 0x40f03a
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x78]
mov dword [ecx + edx*4], edi
inc dword [esp + 8]
cmp dword [esp + 8], edi
jl 0x40f02b
mov dword [esp + 0x10], eax
jmp 0x40f1ed
mov dword [esp + 0xc], 0x914d2edc
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], eax
jl 0x40f1e9
mov dword [esp + 0x30], 0x162c9cc1
mov dword [esp + 0x24], 0xb5c6f8b8
mov dword [esp + 0x30], esi
cmp dword [esp + 0x30], eax
jl 0x40f185
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + ecx*4 + 0x90]
mov ecx, dword [esp + 0x30]
mov dword [esp + ecx*4 + 0x90], edx
xor ecx, ecx
cmp edx, edi
sete cl
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x1c]
mov dword [ecx], edx
mov dword [esp + 0x24], eax
jmp 0x40f171
mov dword [esp + 8], 0xfffffffb
mov dword [esp + 0x28], 0x2a4e6309
mov dword [esp + 8], eax
jmp 0x40f0db
mov dword [esp + 0x1c], 0x5ab06c0e
inc dword [esp + 0x1c]
inc dword [esp + 8]
cmp dword [esp + 8], esi
jle 0x40f0cb
mov dword [esp + 8], eax
jmp 0x40f163
mov dword [esp + 0x14], edi
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], eax
jl 0x40f108
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x78]
cmp dword [ecx + edx*4], eax
jne 0x40f108
dec dword [esp + 0x14]
jns 0x40f0f5
mov ecx, dword [esp + 0xc]
push 0
mov ecx, dword [esp + ecx*4 + 0x94]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x7c]
cmp edx, dword [ecx]
pop ecx
setne cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 8]
cmp dword [esp + 0x1c], ecx
setne dl
sub edx, dword [esp + 0xc]
add edx, 0xeeb4
jne 0x40f144
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x78]
push 2
pop esi
cmp dword [ecx], 5
setne dl
mov dword [esp + 0x14], edx
inc dword [esp + 8]
cmp dword [esp + 8], esi
jle 0x40f0e7
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jle 0x40f0b5
dec dword [esp + 0x30]
jns 0x40f081
mov ecx, dword [esp + 0xc]
cmp dword [esp + ecx*4 + 0x90], eax
jne 0x40f1b5
mov dword [esp + 0x1c], 0xffff
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + ecx*4 + 0x90]
mov ecx, dword [esp + 0x1c]
sub ecx, 0xcfb9
cmp ecx, edx
mov edx, eax
jl 0x40f1b7
mov edx, edi
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + ecx*4 + 0x90]
add ecx, edx
jne 0x40f1ce
mov ecx, eax
cmp dword [esp + 0xc], eax
je 0x40f1d0
mov ecx, edi
mov edx, dword [esp + 0x94]
add edx, ecx
mov ecx, dword [esp + 0x78]
mov dword [ecx], edx
dec dword [esp + 0xc]
jns 0x40f063
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe8
jle 0x40f049
lea ecx, [esp + 0x78]
call fcn.00410a53
xorps xmm0, xmm0
lea ecx, [esp + 0x18c]
push esi
movdqu xmmword [esp + 0xa0], xmm0
call fcn.00410610
xor eax, eax
mov dword [esp + 0x10], 0xc184c506
mov dword [esp + 0x10], eax
jmp 0x40f23c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18c]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x40f22a
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], eax
jl 0x40f270
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x40f26a
push 0x162f
push 0x1971
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
dec dword [esp + 0x10]
jns 0x40f24c
lea ecx, [esp + 0x18c]
call fcn.00410a53
lea eax, [esp + 0x3c]
push eax
call fcn.00410736
push 4
pop edi
mov esi, dword [eax]
mov al, byte [ebp + 0xc]
mov dword [esp + 0x30], esi
test al, al
jne 0x40f29e
test esi, esi
jne 0x40f88a
lea ecx, [esp + 0x200]
mov dl, al
push ecx
mov ecx, dword [esp + 0x40]
call fcn.004017ed
mov esi, eax
lea edi, [esp + 0xa0]
pop ecx
lea ecx, [esp + 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
push edi
call fcn.00410610
mov dword [esp + 8], 0x81c2900
mov dword [esp + 0x24], 0xe5411aa8
mov dword [esp + 0x28], 0xe0e3cec3
mov dword [esp + 0x10], 0
jmp 0x40f301
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x48]
mov dword [eax + ecx*4], 0x1713b910
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x40f2ee
mov dword [esp + 8], 0
cmp dword [esp + 8], 0
jl 0x40f58e
mov dword [esp + 0xc], 0x26a056eb
lea ecx, [esp + 0x118]
mov dword [esp + 0x1c], 0x4b748abb
mov dword [esp + 0x14], 0xd7582ba8
mov dword [esp + 0x10], 0
push 3
call fcn.00410610
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x40f366
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x118]
mov dword [ecx + edx*4], 0x3fccfb42
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x40f350
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x48]
cmp dword [ecx + edx*4], eax
je 0x40f40c
mov ecx, dword [esp + 8]
mov dword [esp + 0x24], 0xfffffff8
mov ecx, dword [esp + 8]
mov dword [esp + 0xc], ecx
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0xc]
imul esi, dword [ecx + edx*4]
neg esi
sbb esi, esi
neg esi
cmp esi, dword [esp + 0x1c]
jl 0x40f3b8
mov ecx, dword [esp + 0x48]
mov esi, edi
cmp dword [ecx], eax
jne 0x40f3ba
mov esi, eax
mov ecx, dword [esp + 8]
xor edx, edx
cmp esi, ecx
push 0
setne dl
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x4c]
cmp edx, dword [ecx]
pop ecx
setle cl
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 8]
cmp edx, ecx
push 0
pop ecx
setge cl
mov edx, edi
cmp ecx, 6
sbb ecx, ecx
add ecx, 0xb32fde57
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x24], 0x6522
jne 0x40f40e
mov edx, eax
mov ecx, dword [esp + 0x48]
cmp edx, dword [ecx]
je 0x40f4ed
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0x5e2d
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], eax
jl 0x40f53e
mov ecx, dword [esp + 0x48]
xor edx, edx
mov dword [esp + 0x14], 0xffffffff
cmp dword [ecx], edi
mov ecx, dword [esp + 0x24]
setl dl
imul ecx, edx
test ecx, ecx
je 0x40f462
mov ecx, edi
cmp dword [esp + 0xc], eax
jne 0x40f464
mov ecx, eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x28]
dec dword [esp + 0x28]
test ecx, ecx
je 0x40f493
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x14], eax
je 0x40f493
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x48]
cmp dword [ecx + edx*4], eax
je 0x40f493
mov esi, edi
cmp dword [esp + 0x14], eax
jne 0x40f495
mov esi, eax
mov ecx, dword [esp + 0x14]
xor edx, edx
cmp ecx, esi
mov ecx, dword [esp + 0x14]
push 0
setne dl
cmp edx, ecx
pop ecx
setle cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x20], ecx
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
setle dl
sub esi, edx
xor edx, edx
cmp ecx, esi
mov ecx, 0x87c3cb87
setl dl
imul edx, dword [esp + 0x1c]
cmp ecx, edx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
dec dword [esp + 0xc]
jns 0x40f43c
jmp 0x40f53e
mov dword [esp + 0x14], 0xfffffffb
mov dword [esp + 0x10], eax
jmp 0x40f50e
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1d8], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x40f4fb
mov ecx, dword [esp + 0x118]
dec dword [ecx]
mov dword [esp + 0x14], eax
jmp 0x40f537
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1d8], 0x50227cdb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x40f524
mov dword [esp + 0xc], eax
jmp 0x40f572
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], eax
jl 0x40f56e
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x40f568
push eax
push 0xdc3
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor eax, eax
dec dword [esp + 0x14]
jns 0x40f54e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x40f544
lea ecx, [esp + 0x118]
call fcn.00410a53
dec dword [esp + 8]
jns 0x40f31a
lea ecx, [esp + 0x48]
call fcn.00410a53
cmp byte [ebp + 0xc], 0
je 0x40f883
cmp dword [esp + 0xa4], 0
je 0x40f883
mov eax, 0x57102d14
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
jmp 0x40f5ec
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x34], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x40f5e0
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], 0x19
jge 0x40f7af
mov esi, 0xe356ec7e
push dword [esp + 0xf0]
movdqa xmm0, xmmword [0xa9f710]
lea ecx, [esp + 0x1cc]
push ecx
lea ecx, [esp + 0x1c0]
mov dword [esp + 0xc0], eax
push ecx
push eax
lea ecx, [esp + 0xc8]
mov dword [esp + 0xcc], eax
movdqu xmmword [esp + 0x1c8], xmm0
mov dword [esp + 0xd0], eax
call fcn.0041187b
mov dword [esp + 0x68], esi
xor eax, eax
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov esi, dword [esp + 0xb8]
mov dword [esi + 0xc], eax
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + ecx*4 + 0xc4]
mov ecx, dword [esi + 0xc]
mov dword [esp + ecx*4 + 0xc4], edx
mov ecx, dword [esi + 0xc]
cmp dword [esp + ecx*4 + 0xc4], eax
jne 0x40f6b0
mov ecx, dword [esp + 0x34]
mov ecx, dword [esi + 0xc]
mov ecx, dword [esp + ecx*4 + 0xc4]
mov ecx, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esi + 0xc]
mov ecx, dword [esp + ecx*4 + 0xc4]
mov dword [esp + 0x70], edi
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x40f6c8
push 0x4dd
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
mov ecx, dword [esp + 0x14]
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 3
jle 0x40f66c
mov dword [esp + 0x14], eax
jmp 0x40f781
mov dword [esp + 0x28], 0x77138bf9
xor edx, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], 0xb5cfe74d
mov dword [esp + 0x24], 0x7fe6
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
test ecx, ecx
mov ecx, dword [esp + 0x6c]
setg dl
add ecx, edx
jne 0x40f72b
mov ecx, dword [esp + 0xb8]
mov esi, eax
cmp dword [ecx + 4], eax
je 0x40f72d
mov esi, edi
mov ecx, dword [esp + 0x34]
xor edx, edx
cmp esi, ecx
setle dl
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x70]
mov ecx, dword [esp + 0x10]
dec edx
neg edx
sbb edx, edx
neg edx
sub edx, ecx
cmp edx, dword [esp + 0x28]
jne 0x40f757
mov ecx, dword [esp + 0x74]
mov ecx, dword [esp + 0x74]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x70]
cmp ecx, edx
mov ecx, dword [esp + 0x28]
push 0
pop edx
setg dl
sub edx, ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x68], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x40f6de
lea ecx, [esp + 0xb8]
call fcn.00410a53
inc dword [esp + 0x34]
mov esi, 0xe356ec7e
cmp dword [esp + 0x34], 0x19
push 0
pop eax
jl 0x40f606
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x20], 9
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 8
push 6
pop edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x20], 0xbac04ee7
mov dword [esp + 0x20], 0x40194ddb
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 0x37a9a971
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 0x2fdcba86
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 0xfffffffb
mov dword [esp + 0x20], 0x831eb239
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 0x4ba8b35e
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0x5f79
push 4
mov dword [esp + 0x24], 0x342f
mov dword [esp + 0xdc], ecx
mov dword [esp + 0x14], eax
pop edi
jmp 0x40f858
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x210], 0x45c1d102
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x40f845
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x40f86f
call dword [sym.imp.USER32.dll_EndMenu]
dec dword [esp + 0x1c]
mov eax, dword [esp + 0xa4]
mov dword [esp + 0xdc], eax
jmp 0x40f886
push 4
pop edi
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], 0xec2e0cf5
mov dword [esp + 0x1c], 0xffff
mov byte [esp + 0x1b], 0
cmp byte [esp + 0x1b], 0
je 0x40f8ae
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [esp + 0xc], 0xffffffe4
jmp 0x40f9f0
push 2
lea ecx, [esp + 0x108]
call fcn.00410610
mov dword [esp + 8], 0xd86e52d8
lea ecx, [esp + 0x124]
mov dword [esp + 0x1c], 0xfffffffb
push 1
call fcn.00410610
xor eax, eax
mov dword [esp + 8], eax
jmp 0x40f905
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x104]
mov dword [ecx + edx*4], 0xfffffff9
inc dword [esp + 8]
cmp dword [esp + 8], 2
jl 0x40f8ef
mov dword [esp + 8], eax
jmp 0x40f928
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x124]
mov dword [ecx + edx*4], 0x236728ad
inc dword [esp + 8]
cmp dword [esp + 8], 1
jl 0x40f912
mov dword [esp + 8], 1
cmp dword [esp + 8], eax
jl 0x40f9d4
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x104]
cmp dword [ecx + edx*4], eax
je 0x40f987
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x104]
push 0
cmp dword [ecx + edx*4], 1
pop ecx
setl cl
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0xc]
cmp ecx, 0x3b37
jle 0x40f987
xor ecx, ecx
inc ecx
jmp 0x40f989
mov ecx, eax
dec ecx
xor edx, edx
cmp ecx, 0x6c71
mov ecx, dword [esp + 0xc]
setl dl
mov dword [esp + 0x20], edx
xor edx, edx
cmp dword [esp + 0x20], ecx
setg dl
mov dword [esp + 0x1c], edx
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
test ecx, ecx
mov ecx, dword [esp + 0x124]
setns dl
mov dword [ecx], edx
dec dword [esp + 8]
jns 0x40f941
lea ecx, [esp + 0x124]
call fcn.00410a53
lea ecx, [esp + 0x104]
call fcn.00410a53
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x1a
jl 0x40f8bb
test esi, esi
jne 0x41001e
cmp dword [esp + 0x9c], esi
jle 0x41001e
mov dword [esp + 0x1c], edi
xor eax, eax
mov dword [esp + 0x28], 0x45f5b1b6
inc esi
mov dword [esp + 0x20], 0xfffffffa
mov dword [esp + 0x20], 0x6e9f0866
mov dword [esp + 0x20], 0x5493e623
mov dword [esp + 0x20], 0x87a5eafb
mov dword [esp + 0x20], eax
push 0xfffffffffffffffb
mov dword [esp + 0x24], 0xc5530c4e
pop ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 2
jge 0x40fa72
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1f0], esi
inc dword [esp + 0x10]
jmp 0x40fa5a
mov ecx, dword [esp + 0x1c]
mov edx, 0x664dc9ed
sub edx, ecx
xor ecx, ecx
cmp edx, 0xe446df3
setle cl
cmp ecx, dword [esp + 0x1c]
jge 0x40fa96
mov ecx, eax
cmp dword [esp + 0x1c], eax
je 0x40fa98
mov ecx, esi
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
inc dword [esp + 0x24]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x1c], 0xfbb9cf7d
mov dword [esp + 0x1c], 0xeadd5d
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0xfffffffa
mov dword [esp + 0x10], eax
jmp 0x40fae5
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x110], 0x609d70ca
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x40fad2
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0xc], eax
je 0x40fb20
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
sub edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x2092
setg cl
mov dword [esp + 0x114], ecx
test ecx, ecx
jne 0x40fb22
mov esi, eax
mov ecx, dword [esp + 0xc]
xor edx, edx
cmp esi, ecx
push 0
sete dl
mov dword [esp + 0x20], edx
xor edx, edx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp ecx, 1
mov ecx, dword [esp + 0x10]
setl dl
sub edx, 6
cmp edx, ecx
pop ecx
setge cl
add ecx, 0xffff17dd
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov esi, dword [esp + 0x1c]
sub esi, dword [esp + 0xc]
neg esi
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [esp + 0xc]
add esi, dword [esp + 0xc]
imul esi, dword [esp + 0xc]
add esi, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
neg esi
cmp esi, ecx
setne dl
cmp edx, dword [esp + 0xc]
jne 0x40fc03
xor esi, esi
mov dword [esp + 0x14], 0xce404d4
inc esi
mov dword [esp + 0x20], esi
cmp dword [esp + 0x14], eax
jne 0x40fbc0
mov edx, eax
cmp dword [esp + 0x110], eax
je 0x40fbc2
mov edx, esi
mov ecx, dword [esp + 0x14]
sub edx, ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], eax
jmp 0x40fbfa
mov dword [esp + 0xc], eax
jmp 0x40fbf0
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x40fbec
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x40fbd8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x17
jge 0x40fbd2
jmp 0x40fc17
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], al
je 0x40fc14
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor esi, esi
inc esi
mov byte [esp + 0x1b], 0
cmp byte [esp + 0x1b], 0
je 0x40fc2a
push esi
call dword [sym.imp.USER32.dll_ShowCursor]
cmp dword [esp + 0xa0], 0
je 0x41001e
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0
jmp 0x40fc59
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xac], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x40fc46
push 2
mov dword [esp + 0x10], 0
pop edi
jmp 0x40fe78
mov dword [esp + 0x14], 0xba339924
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], 0
jl 0x40fe74
mov dword [esp + 0x24], 0x274bf90e
lea ecx, [esp + 0x154]
push edi
call fcn.00410610
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x5b5b06a8
mov dword [esp + 0x10], 0
jmp 0x40fccc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x40fcb6
mov dword [esp + 0x24], 0
jmp 0x40fe54
mov dword [esp + 8], esi
mov dword [esp + 8], edi
cmp dword [esp + 8], 0
jl 0x40fe50
mov dword [esp + 0x28], 0xdaab72b2
lea ecx, [esp + 0x13c]
mov dword [esp + 0x10], 0xfffffff6
push esi
call fcn.00410610
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x40fd2a
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x13c]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x40fd17
mov dword [esp + 0x28], edi
cmp dword [esp + 0x28], eax
jl 0x40fd6c
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], eax
jl 0x40fd66
mov dword [esp + 0x10], 8
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
dec dword [esp + 0x1c]
jns 0x40fd50
dec dword [esp + 0x28]
jns 0x40fd3a
mov ecx, dword [esp + 8]
cmp dword [esp + ecx*4 + 0xac], eax
jne 0x40fdfd
cmp dword [esp + 0xc], eax
jne 0x40fdcd
mov ecx, dword [esp + 8]
push 0
mov edx, dword [esp + ecx*4 + 0xb0]
mov ecx, dword [esp + 0x28]
cmp ecx, edx
pop ecx
setg cl
xor edx, edx
cmp ecx, 0xdaba
mov ecx, dword [esp + 0x14]
push 0
setl dl
cmp edx, ecx
mov ecx, dword [esp + 0xc]
pop edx
setge dl
sub edx, dword [esp + ecx*4 + 0xac]
sub edx, dword [esp + 0x14]
neg edx
sbb edx, edx
inc edx
cmp dword [esp + 8], edx
mov edx, eax
jg 0x40fdcf
mov edx, esi
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
add ecx, edx
xor edx, edx
add esi, ecx
mov ecx, dword [esp + 0x154]
cmp esi, dword [ecx + 4]
setge dl
xor esi, esi
inc esi
cmp edx, 0xe155
jle 0x40fdfd
mov ecx, eax
cmp dword [esp + 8], eax
je 0x40fdff
mov ecx, esi
xor eax, eax
cmp ecx, 9
lea ecx, [esp + 0x13c]
sete al
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov eax, dword [esp + eax*4 + 0xac]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xac]
mov eax, dword [esp + 0x13c]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
call fcn.00410a53
dec dword [esp + 8]
jns 0x40fcf2
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jle 0x40fcdf
lea ecx, [esp + 0x154]
call fcn.00410a53
dec dword [esp + 0x14]
jns 0x40fc87
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x40fc70
mov dword [esp + 0xc], 0
jmp 0x40fe9f
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xac], 0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x40fe8c
push dword [esp + 0xa0]
push 0x3996
push 0x18f3
push esi
push 0x38a2
push 0x672f
push 0x75d2
push esi
call fcn.0040d3c4
push dword [esp + 0xc0]
call fcn.00462db3
movdqa xmm0, xmmword [0xa9f6d0]
lea ecx, [esp + 0x21c]
add esp, 0x24
mov dword [esp + 8], 0xc7a00f47
mov esi, eax
mov dword [esp + 0x14], edi
lea eax, [esp + 0x1d8]
mov dword [esp + 0x1c], 0x7eed050b
mov dword [esp + 0x1c], 0xe13c9534
push eax
lea eax, [esp + 0x1cc]
mov dword [esp + 0x34], esi
push eax
movdqu xmmword [esp + 0x1d0], xmm0
call fcn.004106c0
push ecx
lea ecx, [esp + 0x1e8]
push dword [eax + 4]
push dword [eax]
call fcn.00410686
mov dword [esp + 0x20], 0x34fd39ef
mov byte [esp + 0x1b], 0
cmp byte [esp + 0x1b], 0
je 0x40ff63
push 0xc97
push 0x118d
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov eax, dword [esp + 8]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x14]
jg 0x40ff7a
cmp dword [esp + 8], 0
jne 0x40ff7e
mov eax, dword [esp + 8]
mov eax, dword [esp + 8]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x6848298b
setle al
xor edx, edx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x14]
mov eax, dword [esp + 8]
cmp eax, ecx
mov eax, dword [esp + 8]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 8]
cmp ecx, eax
setl dl
add edx, dword [esp + 8]
je 0x40ffe8
mov dword [esp + 0x1c], 1
dec dword [esp + 0x1c]
jmp 0x410004
mov dword [esp + 0x14], 0xb
jmp 0x40fffd
cmp dword [esp + 0x14], 0
jne 0x410004
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1f
jge 0x40fff2
lea ecx, [esp + 0x1e4]
call fcn.004106ac
lea eax, [esp + 0x3c]
push eax
call fcn.00410736
mov dword [eax], esi
jmp 0x410021
push 2
pop edi
mov eax, 0x5bb2c213
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
push 3
mov dword [esp + 0x18], 9
mov dword [esp + 0x18], 0
pop esi
jmp 0x41013c
push esi
lea ecx, [esp + 0xfc]
call fcn.00410610
mov dword [esp + 0x10], 0
jmp 0x410075
push dword [esp + 0x10]
call fcn.004106b1
or dword [eax], 0xffffffff
inc dword [esp + 0x10]
lea ecx, [esp + 0xf8]
cmp dword [esp + 0x10], esi
jl 0x410065
push 0
call fcn.004106b1
mov edx, eax
xor eax, eax
mov dword [edx], eax
mov dword [esp + 0x10], eax
jmp 0x4100a5
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x40], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x410095
mov dword [esp + 0x44], esi
cmp dword [esp + 0x44], eax
jl 0x41011c
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x54]
imul ecx, dword [esp + 0x60], 0xf609
test ecx, ecx
je 0x410108
cmp dword [esp + 0x40], eax
je 0x410108
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x54]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x54]
mov ecx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x14]
cmp dword [esp + ecx*4 + 0x54], eax
je 0x4100f8
cmp dword [esp + 0x40], eax
je 0x4100f8
xor ecx, ecx
inc ecx
jmp 0x4100fa
mov ecx, eax
imul ecx, ecx, 0xfbeb
test ecx, ecx
je 0x410108
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x60]
mov ecx, dword [edx]
mov dword [esp + ecx*4 + 0x54], 0xbe3d0e72
dec dword [esp + 0x44]
jns 0x4100b5
inc dword [edx]
cmp dword [edx], esi
jle 0x41008f
lea ecx, [esp + 0xf8]
cmp dword [esp + 0x60], eax
jne 0x410148
call fcn.004106ac
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x41004e
jmp 0x41014d
call fcn.004106ac
lea ecx, [esp + 0x9c]
call fcn.004090fc
mov dword [esp + 0x14], 0xfffffff8
xor eax, eax
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x28], 0x466a
mov dword [esp + 0x28], 0x813c27f3
mov dword [esp + 0x1c], 0x8bbd1883
mov dword [esp + 0x10], eax
jmp 0x410199
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x38], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x410189
cmp dword [esp + 0x38], eax
jne 0x410207
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
imul ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x4101bb
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
sub ecx, 0x6335
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x28], 0xfffd
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
cmp ecx, edx
push 0
pop ecx
setg cl
cmp ecx, dword [esp + 0x14]
jl 0x410207
mov esi, eax
jmp 0x41020a
xor esi, esi
inc esi
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x14]
setl dl
mov dword [esp + 0x20], edx
xor edx, edx
cmp ecx, dword [esp + 0x20]
setl dl
cmp edx, dword [esp + 0x1c]
jne 0x410232
cmp dword [esp + 0x28], eax
jne 0x410241
cmp dword [esp + 0x14], eax
jne 0x410241
xor esi, esi
mov dword [esp + 0x14], eax
inc esi
jmp 0x410248
xor esi, esi
inc esi
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x41040f
mov edx, dword [esp + 0x2c]
call fcn.0040e96c
mov edi, eax
lea ecx, [esp + 0x16c]
push esi
mov dword [esp + 0xd8], edi
call fcn.00410610
mov dword [esp + 0x28], 0x90a3cfce
lea ecx, [esp + 0x178]
push 2
pop eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0x3e93d0b5
mov dword [esp + 0x2c], 0xeb9e
mov dword [esp + 0x2c], 0x215256ee
mov dword [esp + 0x2c], 0x720348f4
mov dword [esp + 0x2c], 0
mov dword [esp + 0x2c], 0x426a7609
mov dword [esp + 0x2c], 0x88e10e5e
mov dword [esp + 0x2c], 0xabc24891
mov dword [esp + 0x2c], 0xf05f4326
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], 0xfffffff8
push eax
call fcn.00410610
mov dword [esp + 0x24], 0x5f992db7
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 0x8ce22955
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 0x5de082ad
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 8], eax
cmp dword [esp + 8], esi
jge 0x410339
push dword [esp + 8]
lea ecx, [esp + 0x170]
call fcn.004106b1
mov dword [eax], esi
inc dword [esp + 8]
cmp dword [esp + 8], esi
jl 0x41031b
xor eax, eax
mov dword [esp + 8], eax
cmp dword [esp + 8], 2
jge 0x410364
push dword [esp + 8]
lea ecx, [esp + 0x17c]
call fcn.004106b1
and dword [eax], 0
inc dword [esp + 8]
cmp dword [esp + 8], 2
jl 0x410344
xor eax, eax
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp ecx, esi
setge dl
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2c], eax
jne 0x41037f
cmp dword [esp + 0x20], eax
je 0x410385
cmp dword [esp + 0x30], eax
jne 0x410387
mov esi, eax
inc dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esp + 0x1c]
cmp ecx, esi
setle dl
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], 2
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x2c], ecx
jl 0x4103ca
cmp dword [esp + 0x10], eax
jne 0x4103ca
mov ecx, eax
jmp 0x4103cd
xor ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x16c]
push eax
call fcn.004106b1
mov ecx, dword [esp + 0x2c]
imul ecx, dword [eax]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x178]
call fcn.004106ac
lea ecx, [esp + 0x16c]
call fcn.004106ac
lea eax, [esp + 0x64]
push eax
call fcn.004106d4
mov dword [eax], edi
xor eax, eax
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x1a0]
push 3
call fcn.00410610
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 0x1a4e
mov dword [esp + 0x20], 2
mov dword [esp + 0x20], 0xfa55
mov dword [esp + 0x2c], 0x9e56
mov dword [esp + 8], 0
jmp 0x410466
mov eax, dword [esp + 8]
mov dword [esp + eax*4 + 0x188], 0x4f01
inc dword [esp + 8]
cmp dword [esp + 8], 1
jl 0x410453
mov dword [esp + 8], 0
jmp 0x41048a
push dword [esp + 8]
call fcn.004106b1
mov dword [eax], 0xa75c19c5
inc dword [esp + 8]
cmp dword [esp + 8], 3
lea ecx, [esp + 0x1a0]
jl 0x410477
inc dword [esp + 0x2c]
call fcn.004106ac
mov eax, dword [ebp + 8]
lea esi, [esp + 0xd4]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret