Function at 0x406900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x415d3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
mov eax, dword [0x41b168]
xor eax, dword [esp + 0x224]
push ebx
mov ebx, dword [esp + 0x22c]
push ebp
push esi
mov dword [esp + 0x220], eax
push edi
mov dword [esp + 0x18], ecx
lea ebp, [ebx + 0x20]
mov eax, dword [esp + 0x18]
xor esi, esi
push 0xffffffffffffffff
push esi
add eax, 0x64
push eax
lea ecx, [ebx + 4]
mov dword [ebx], esi
call fcn.00401838
mov eax, 0x41727d
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x406960
sub eax, ecx
push eax
push 0x41727d
mov ecx, ebp
call fcn.004018c7
mov eax, dword [ebx + 0x5c]
mov ecx, dword [eax + 4]
lea edi, [ebx + 0x58]
push ecx
mov ecx, edi
call fcn.00402756
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [edi + 8], esi
mov dword [eax], eax
mov eax, dword [edi + 4]
push 0xffffffffffffffff
push esi
lea ecx, [ebx + 0x3c]
mov dword [eax + 8], eax
call fcn.0040171e
mov eax, 0xf
mov byte [esp + 0x16], 0
mov byte [esp + 0x1f], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x17], 0
mov dword [esp + 0x90], eax
mov dword [esp + 0x8c], esi
mov byte [esp + 0x7c], 0
mov dword [esp + 0x230], esi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], esi
mov byte [esp + 0x28], 0
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
mov ebx, dword [esp + 0x238]
mov byte [esp + 0x230], 2
mov esi, dword [esp + 0x18]
mov eax, dword [esi + 0x5c]
test eax, eax
jbe 0x406a78
mov eax, dword [esi + 0x60]
lea ecx, [esi + 0x48]
mov edi, 0x10
cmp eax, edi
jb 0x406a21
mov eax, dword [ecx + 4]
jmp 0x406a24
lea eax, [ecx + 4]
mov dl, byte [eax]
cmp dword [ecx + 0x18], edi
mov byte [esp + 0x20], dl
jb 0x406a34
mov eax, dword [ecx + 4]
jmp 0x406a37
lea eax, [ecx + 4]
lea edx, [eax + 1]
cmp dword [ecx + 0x18], edi
jb 0x406a44
mov esi, dword [ecx + 4]
jmp 0x406a47
lea esi, [ecx + 4]
cmp dword [ecx + 0x18], edi
jb 0x406a51
mov edi, dword [ecx + 4]
jmp 0x406a54
lea edi, [ecx + 4]
test esi, esi
jne 0x406a5c
xor eax, eax
jmp 0x406a60
mov eax, esi
sub eax, edi
test edx, edx
jne 0x406a6d
push edx
push eax
call fcn.0040171e
jmp 0x406a9e
sub edx, esi
push edx
push eax
call fcn.0040171e
jmp 0x406a9e
mov eax, dword [esi + 0x40]
test eax, eax
je 0x407be4
push eax
push 1
lea eax, [esp + 0x28]
push 1
push eax
call fcn.0040c727
add esp, 0x10
cmp eax, 1
jne 0x407be0
mov cl, byte [esp + 0x20]
cmp cl, 0xa
jne 0x406aae
mov eax, dword [esp + 0x18]
inc dword [eax + 0x3c]
mov eax, dword [ebx]
cmp eax, 5
jne 0x406b7f
mov ecx, dword [esp + 0x20]
push ecx
lea edi, [ebx + 0x3c]
push 1
mov ecx, edi
call fcn.00403aa5
cmp byte [esp + 0x20], 0x3e
mov edx, dword [edi + 0x14]
jne 0x406a02
cmp edx, 3
jl 0x406a02
mov esi, dword [edi + 0x18]
cmp esi, 0x10
lea eax, [edi + 4]
jb 0x406af0
mov ecx, dword [eax]
jmp 0x406af2
mov ecx, eax
cmp byte [edx + ecx - 2], 0x2d
jne 0x406a02
cmp esi, 0x10
jb 0x406b04
mov eax, dword [eax]
cmp byte [edx + eax - 3], 0x2d
jne 0x406a02
add edx, 0xfffffffd
push edx
xor esi, esi
push esi
lea ecx, [esp + 0x14c]
push ecx
mov ecx, edi
call fcn.00403f44
push 0xffffffffffffffff
push esi
push eax
mov ecx, edi
mov byte [esp + 0x23c], 3
call fcn.00401838
mov eax, dword [esp + 0x15c]
mov edi, 0x10
cmp eax, edi
mov byte [esp + 0x230], 2
jb 0x406b60
mov edx, dword [esp + 0x148]
push edx
call fcn.0040b5ad
add esp, 4
mov dword [esp + 0x15c], 0xf
mov dword [esp + 0x158], esi
mov byte [esp + 0x148], 0
jmp 0x407543
cmp eax, 4
jne 0x406c55
mov eax, dword [ebx + 0x50]
test eax, eax
mov esi, ebp
jne 0x406ba1
movsx edx, cl
push edx
call fcn.0040c604
add esp, 4
test eax, eax
je 0x406ba4
lea esi, [ebx + 0x3c]
mov eax, dword [esp + 0x20]
push eax
push 1
mov ecx, esi
call fcn.00403aa5
cmp byte [esp + 0x20], 0x3e
mov eax, dword [esi + 0x14]
jne 0x406a02
cmp eax, 2
jl 0x406a02
mov ecx, dword [esi + 0x18]
mov edi, 0x10
cmp ecx, edi
jb 0x406bda
mov ecx, dword [esi + 4]
jmp 0x406bdd
lea ecx, [esi + 4]
cmp byte [ecx + eax - 2], 0x3f
jne 0x406a02
add eax, 0xfffffffe
push eax
push 0
lea eax, [esp + 0x168]
push eax
mov ecx, esi
call fcn.00403f44
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov byte [esp + 0x23c], 4
call fcn.00401838
cmp dword [esp + 0x178], edi
mov byte [esp + 0x230], 2
jb 0x406c32
mov ecx, dword [esp + 0x164]
push ecx
call fcn.0040b5ad
add esp, 4
mov dword [esp + 0x178], 0xf
mov dword [esp + 0x174], 0
mov byte [esp + 0x164], 0
jmp 0x40753c
cmp cl, 0x22
mov dl, byte [esp + 0x1f]
jne 0x406c7d
test dl, dl
sete dl
test eax, eax
mov byte [esp + 0x1f], dl
je 0x406dc8
cmp eax, 3
jne 0x406a02
jmp 0x406dc2
test dl, dl
jne 0x406dc2
cmp cl, 0x3c
jne 0x406ca6
cmp eax, 3
je 0x407009
test eax, eax
jne 0x407738
mov dword [ebx], 1
jmp 0x406a02
cmp cl, 0x3e
je 0x40707c
cmp cl, 0x2f
jne 0x406cf0
cmp eax, 1
jne 0x406d31
mov eax, 0x41727d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406cc1
sub eax, edx
push eax
mov eax, dword [ebp + 0x14]
push 0x41727d
push eax
push 0
mov ecx, ebp
call fcn.00401143
test eax, eax
jne 0x406cec
mov dword [ebx], 2
jmp 0x406a02
mov cl, byte [esp + 0x20]
cmp cl, 0x3f
jne 0x406d31
cmp dword [ebx], 1
jne 0x406d31
mov eax, 0x41727d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406d02
mov ecx, dword [ebp + 0x14]
sub eax, edx
push eax
push 0x41727d
push ecx
push 0
mov ecx, ebp
call fcn.00401143
test eax, eax
jne 0x406d2d
mov dword [ebx], 4
jmp 0x406a02
mov cl, byte [esp + 0x20]
movzx edx, cl
push edx
call fcn.0040c604
add esp, 4
test eax, eax
je 0x406db5
mov eax, 0x41727d
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406d50
sub eax, edx
push eax
mov eax, dword [ebp + 0x14]
push 0x41727d
push eax
push 0
mov ecx, ebp
call fcn.00401143
test eax, eax
je 0x406d75
mov byte [esp + 0x16], 1
cmp dword [ebx], 1
jne 0x406a02
mov eax, 0x417754
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406d86
mov ecx, dword [ebp + 0x14]
sub eax, edx
push eax
push 0x417754
push ecx
push 0
mov ecx, ebp
call fcn.00401143
test eax, eax
jne 0x406a02
mov dword [ebx], 5
jmp 0x406a02
mov cl, byte [esp + 0x20]
cmp cl, 0x20
jbe 0x407b25
mov eax, dword [ebx]
test eax, eax
jne 0x406e0e
mov dword [ebx], 3
mov al, byte [esp + 0x16]
test al, al
je 0x406dfb
mov eax, 0x417750
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406de0
sub eax, edx
push eax
push 0x417750
mov ecx, ebp
call fcn.004017a8
mov byte [esp + 0x16], 0
mov eax, dword [esp + 0x20]
push eax
push 1
mov ecx, ebp
call fcn.00403aa5
jmp 0x406a02
cmp eax, 1
jne 0x406dce
mov al, byte [esp + 0x16]
test al, al
je 0x406fa5
mov al, byte [esp + 0x10]
test al, al
je 0x406f96
mov al, byte [esp + 0x17]
test al, al
jne 0x406e3d
cmp cl, 0x3d
jne 0x406e49
jmp 0x406fa0
mov eax, dword [esp + 0x38]
test eax, eax
jbe 0x406fa0
lea edx, [esp + 0x78]
push edx
lea eax, [esp + 0x19c]
push eax
call fcn.00407f60
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x84]
mov byte [esp + 0x23c], 0x15
call fcn.00401838
mov eax, dword [esp + 0x1b0]
mov edi, 0x10
cmp eax, edi
mov byte [esp + 0x230], 2
jb 0x406e9f
mov ecx, dword [esp + 0x19c]
push ecx
call fcn.0040b5ad
add esp, 4
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x1d4]
mov esi, 0xf
push eax
mov dword [esp + 0x1b8], esi
mov dword [esp + 0x1b4], 0
mov byte [esp + 0x1a4], 0
call fcn.00407f60
add esp, 8
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x23c], 0x16
call fcn.00401838
cmp dword [esp + 0x1e8], edi
mov byte [esp + 0x230], 2
jb 0x406f0a
mov ecx, dword [esp + 0x1d4]
push ecx
call fcn.0040b5ad
add esp, 4
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x7c]
push eax
push ebx
mov dword [esp + 0x1f4], esi
mov dword [esp + 0x1f0], 0
mov byte [esp + 0x1e0], 0
call fcn.004066f0
mov eax, 0x41727d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406f40
sub eax, edx
push eax
push 0x41727d
lea ecx, [esp + 0x80]
call fcn.004018c7
mov eax, 0x41727d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406f63
sub eax, edx
push eax
push 0x41727d
lea ecx, [esp + 0x2c]
call fcn.004018c7
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x80]
push ecx
lea ecx, [esp + 0x4c]
call fcn.00401838
mov cl, byte [esp + 0x20]
jmp 0x406f9b
mov byte [esp + 0x10], 1
mov byte [esp + 0x17], 0
mov byte [esp + 0x16], 0
mov al, byte [esp + 0x10]
test al, al
jne 0x406fc8
mov ecx, ebp
test ecx, ecx
je 0x406a02
mov edx, dword [esp + 0x20]
push edx
push 1
call fcn.00403aa5
jmp 0x406a02
cmp cl, 0x3d
jne 0x406fd7
mov byte [esp + 0x17], 1
jmp 0x406a02
mov al, byte [esp + 0x17]
test al, al
jne 0x406ff4
mov edx, dword [esp + 0x20]
push edx
lea ecx, [esp + 0x7c]
push 1
call fcn.00403aa5
jmp 0x406a02
mov edx, dword [esp + 0x20]
push edx
lea ecx, [esp + 0x28]
push 1
call fcn.00403aa5
jmp 0x406a02
mov esi, dword [esp + 0x18]
add esi, 0x48
push esi
lea edx, [esp + 0x12c]
push 0x3c
push edx
call fcn.00405f50
add esp, 0xc
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov byte [esp + 0x23c], 5
call fcn.00401838
cmp dword [esp + 0x140], 0x10
mov byte [esp + 0x230], 2
jb 0x407059
mov eax, dword [esp + 0x12c]
push eax
call fcn.0040b5ad
add esp, 4
mov dword [esp + 0x140], 0xf
mov dword [esp + 0x13c], 0
mov byte [esp + 0x12c], 0
jmp 0x40753c
mov eax, dword [ebx]
cmp eax, 1
jne 0x4073f0
mov eax, 0x4176c8
xor bl, bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407091
mov ecx, dword [esp + 0x8c]
sub eax, edx
push eax
push 0x4176c8
push ecx
push 0
lea ecx, [esp + 0x88]
call fcn.00401143
test eax, eax
je 0x4072ac
mov eax, dword [esp + 0x8c]
test eax, eax
jbe 0x407140
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x80]
push edx
lea ecx, [esp + 0x4c]
call fcn.00401838
mov esi, dword [esp + 0x238]
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x44]
push ecx
push esi
mov ecx, edi
call fcn.004066f0
mov eax, 0x41727d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407103
sub eax, edx
push eax
push 0x41727d
lea ecx, [esp + 0x80]
call fcn.004018c7
mov eax, 0x41727d
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407126
sub eax, edx
push eax
push 0x41727d
lea ecx, [esp + 0x2c]
call fcn.004018c7
jmp 0x40714b
mov esi, dword [esp + 0x238]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x54]
test eax, eax
jbe 0x40724b
lea edx, [esp + 0x40]
push edx
lea ecx, [esi + 0x58]
call fcn.00406820
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0xa4]
mov dword [esp + 0xbc], 0xf
mov dword [esp + 0xb8], 0
mov byte [esp + 0xa8], 0
call fcn.00401838
mov eax, dword [esp + 0xac]
test eax, eax
mov byte [esp + 0x230], 7
jle 0x407201
cmp dword [esp + 0xb0], 0x10
mov ecx, dword [esp + 0x9c]
jae 0x4071be
lea ecx, [esp + 0x9c]
cmp byte [eax + ecx - 1], 0x2f
jne 0x407201
dec eax
push eax
push 0
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0xa4]
call fcn.00403f44
push eax
lea ecx, [esp + 0x44]
push ecx
push esi
mov ecx, edi
mov byte [esp + 0x23c], 8
call fcn.004066f0
lea ecx, [esp + 0x1ec]
call fcn.004014b8
mov bl, 1
cmp dword [esp + 0xb0], 0x10
mov byte [esp + 0x230], 2
jb 0x407223
mov edx, dword [esp + 0x9c]
push edx
call fcn.0040b5ad
add esp, 4
test bl, bl
mov dword [esp + 0xb0], 0xf
mov dword [esp + 0xac], 0
mov byte [esp + 0x9c], 0
je 0x4073b8
jmp 0x4072b0
mov eax, dword [esi + 0x34]
test eax, eax
jle 0x4073b8
cmp dword [ebp + 0x18], 0x10
jb 0x407261
mov ecx, dword [ebp + 4]
jmp 0x407264
lea ecx, [ebp + 4]
cmp byte [ecx + eax - 1], 0x2f
jne 0x4073b8
dec eax
push eax
push 0
lea eax, [esp + 0x210]
push eax
mov ecx, ebp
call fcn.00403f44
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebp
mov byte [esp + 0x23c], 9
call fcn.00401838
lea ecx, [esp + 0x208]
mov byte [esp + 0x230], 2
call fcn.004014b8
jmp 0x4072b0
mov edi, dword [esp + 0x18]
push ebp
lea ecx, [esp + 0x10c]
push 0x41774c
push ecx
call fcn.00402073
push 0x417748
push eax
lea edx, [esp + 0x190]
push edx
mov byte [esp + 0x248], 0xa
call fcn.00402027
lea esi, [edi + 0x48]
push esi
push eax
lea eax, [esp + 0x1d4]
push eax
mov byte [esp + 0x254], 0xb
call fcn.00406000
add esp, 0x24
push 0xffffffffffffffff
xor ebx, ebx
push ebx
push eax
mov ecx, esi
mov byte [esp + 0x23c], 0xc
call fcn.00401838
mov eax, dword [esp + 0x1cc]
mov esi, 0x10
cmp eax, esi
jb 0x407330
mov ecx, dword [esp + 0x1b8]
push ecx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x194], esi
mov dword [esp + 0x1cc], 0xf
mov dword [esp + 0x1c8], ebx
mov byte [esp + 0x1b8], 0
jb 0x407363
mov edx, dword [esp + 0x180]
push edx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x120], esi
mov dword [esp + 0x194], 0xf
mov dword [esp + 0x190], ebx
mov byte [esp + 0x180], 0
mov byte [esp + 0x230], 2
jb 0x40739e
mov eax, dword [esp + 0x10c]
push eax
call fcn.0040b5ad
add esp, 4
mov dword [esp + 0x120], 0xf
mov dword [esp + 0x11c], ebx
mov byte [esp + 0x10c], 0
mov eax, dword [edi + 0x78]
test eax, eax
je 0x4073de
mov eax, 0x4176c8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4073c7
sub eax, edx
push eax
push 0x4176c8
lea ecx, [edi + 0x64]
call fcn.004017a8
push 0xffffffffffffffff
push 0
push ebp
lea ecx, [edi + 0x64]
call fcn.00401689
jmp 0x407535
cmp eax, 2
jne 0x407a6a
mov edi, dword [esp + 0x18]
push 1
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
push ecx
lea ebx, [edi + 0x64]
mov ecx, ebx
mov byte [esp + 0x1c], 0x2f
call fcn.00403707
mov esi, eax
cmp esi, 0xffffffff
jne 0x407427
mov eax, dword [edi + 0x78]
test eax, eax
je 0x4077e1
push 0xffffffffffffffff
lea edx, [esi + 1]
push edx
lea eax, [esp + 0x64]
push eax
mov ecx, ebx
call fcn.00403f44
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov edi, 0x10
cmp ecx, edi
mov byte [esp + 0x230], 0xe
jb 0x407455
mov ecx, dword [ebp + 4]
jmp 0x407458
lea ecx, [ebp + 4]
push eax
push ecx
mov ecx, dword [esp + 0x78]
push ecx
push 0
lea ecx, [esp + 0x6c]
call fcn.00401143
test eax, eax
jne 0x407874
cmp esi, 0xffffffff
jne 0x4074c4
push ecx
mov edx, esp
mov dword [esp + 0x98], esp
push edx
mov ecx, ebx
call fcn.00405ca0
cmp dword [ebx + 0x18], edi
push ecx
mov dword [esp + 0x9c], esp
mov ecx, esp
jb 0x4074ae
mov eax, dword [ebx + 4]
mov dword [ecx], eax
lea eax, [esp + 0x9c]
push eax
mov ecx, ebx
call fcn.00403b6f
jmp 0x407505
lea eax, [ebx + 4]
mov dword [ecx], eax
lea eax, [esp + 0x9c]
push eax
mov ecx, ebx
call fcn.00403b6f
jmp 0x407505
cmp dword [ebx + 0x18], edi
jb 0x4074ce
mov edi, dword [ebx + 4]
jmp 0x4074d1
lea edi, [ebx + 4]
push ecx
mov ecx, esp
mov dword [esp + 0x98], esp
push ecx
mov ecx, ebx
call fcn.00405ca0
push ecx
mov eax, esp
lea edx, [esp + 0x12c]
mov dword [esp + 0x9c], esp
add edi, esi
push edx
mov ecx, ebx
mov dword [eax], edi
call fcn.00403b6f
mov edi, 0x10
cmp dword [esp + 0x74], edi
mov byte [esp + 0x230], 2
jb 0x407520
mov eax, dword [esp + 0x60]
push eax
call fcn.0040b5ad
add esp, 4
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
mov ebx, dword [esp + 0x238]
xor esi, esi
mov edi, 0x10
cmp dword [esp + 0x8c], esi
jbe 0x407631
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0xd4]
push edx
call fcn.00407f60
add esp, 8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [esp + 0x84]
mov byte [esp + 0x23c], 0x18
call fcn.00401838
cmp dword [esp + 0xe8], edi
mov byte [esp + 0x230], 2
jb 0x40759e
mov eax, dword [esp + 0xd4]
push eax
call fcn.0040b5ad
add esp, 4
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0xb8]
push edx
mov dword [esp + 0xf0], 0xf
mov dword [esp + 0xec], esi
mov byte [esp + 0xdc], 0
call fcn.00407f60
add esp, 8
push 0xffffffffffffffff
push esi
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x23c], 0x19
call fcn.00401838
cmp dword [esp + 0xcc], edi
mov byte [esp + 0x230], 2
jb 0x407603
mov eax, dword [esp + 0xb8]
push eax
call fcn.0040b5ad
add esp, 4
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x7c]
push edx
push ebx
mov dword [esp + 0xd8], 0xf
mov dword [esp + 0xd4], esi
mov byte [esp + 0xc4], 0
call fcn.004066f0
lea eax, [esp + 0xec]
push ebp
push eax
call fcn.00407f60
add esp, 8
push 0xffffffffffffffff
push esi
push eax
mov ecx, ebp
mov byte [esp + 0x23c], 0x1a
call fcn.00401838
cmp dword [esp + 0x104], edi
mov byte [esp + 0x230], 2
jb 0x407676
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.0040b5ad
add esp, 4
cmp dword [ebx], 5
mov dword [esp + 0x104], 0xf
mov dword [esp + 0x100], esi
mov byte [esp + 0xf0], 0
jne 0x407a05
mov edx, dword [esp + 0x18]
mov al, byte [edx + 0x45]
test al, al
jne 0x407a05
cmp dword [esp + 0x58], edi
jb 0x4076bb
mov eax, dword [esp + 0x44]
push eax
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
jb 0x4076df
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x90], edi
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], esi
mov byte [esp + 0x28], 0
mov dword [esp + 0x230], 0xffffffff
jb 0x407711
mov edx, dword [esp + 0x7c]
push edx
call fcn.0040b5ad
add esp, 4
mov ebx, dword [esp + 0x238]
mov dword [esp + 0x90], 0xf
mov dword [esp + 0x8c], 0
mov byte [esp + 0x7c], 0
jmp 0x406940
mov edi, 0xf
mov eax, 0x417738
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407756
sub eax, edx
push eax
push 0x417738
lea ecx, [esp + 0x64]
call fcn.004018c7
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x5c]
push eax
mov byte [esp + 0x234], 6
call fcn.004061b0
mov eax, dword [esp + 0x74]
mov esi, 0x10
cmp eax, esi
jb 0x40779e
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x58], esi
jb 0x4077b1
mov edx, dword [esp + 0x44]
push edx
call fcn.0040b5ad
add esp, 4
mov eax, dword [esp + 0x3c]
xor ebx, ebx
cmp eax, esi
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
jb 0x4077d4
mov eax, dword [esp + 0x28]
push eax
call fcn.0040b5ad
add esp, 4
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
jmp 0x407b09
mov ebx, 0xf
mov eax, 0x417728
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xac], 0
mov byte [esp + 0x9c], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407808
sub eax, edx
push eax
push 0x417728
lea ecx, [esp + 0xa0]
call fcn.004018c7
lea edx, [esp + 0x98]
push edx
mov ecx, edi
mov byte [esp + 0x234], 0xd
call fcn.004061b0
mov eax, dword [esp + 0xb0]
mov esi, 0x10
cmp eax, esi
jb 0x40785a
mov eax, dword [esp + 0x9c]
push eax
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x58], esi
jb 0x40786d
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0040b5ad
add esp, 4
xor edi, edi
jmp 0x407b9c
push ebp
lea ecx, [esp + 0x10c]
push 0x417720
push ecx
call fcn.00402073
push 0x417708
push eax
lea edx, [esp + 0xe4]
push edx
mov byte [esp + 0x248], 0xf
call fcn.00402027
lea ecx, [esp + 0x74]
push ecx
push eax
lea edx, [esp + 0xd4]
push edx
mov byte [esp + 0x254], 0x10
call fcn.00406000
push 0x417230
push eax
lea eax, [esp + 0x118]
push eax
mov byte [esp + 0x260], 0x11
call fcn.00402027
add esp, 0x30
mov ecx, dword [esp + 0x18]
push eax
mov byte [esp + 0x234], 0x12
call fcn.004061b0
cmp dword [esp + 0x104], edi
jb 0x407906
mov ecx, dword [esp + 0xf0]
push ecx
call fcn.0040b5ad
add esp, 4
mov eax, dword [esp + 0xcc]
xor esi, esi
cmp eax, edi
mov ebx, 0xf
mov dword [esp + 0x104], ebx
mov dword [esp + 0x100], esi
mov byte [esp + 0xf0], 0
jb 0x40793e
mov edx, dword [esp + 0xb8]
push edx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0xe8], edi
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xc8], esi
mov byte [esp + 0xb8], 0
jb 0x40796d
mov eax, dword [esp + 0xd4]
push eax
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x120], edi
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xe4], esi
mov byte [esp + 0xd4], 0
jb 0x40799c
mov ecx, dword [esp + 0x10c]
push ecx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x74], edi
jb 0x4079af
mov edx, dword [esp + 0x60]
push edx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x58], edi
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], esi
mov byte [esp + 0x60], 0
jb 0x4079cf
mov eax, dword [esp + 0x44]
push eax
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
jb 0x4079ef
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0040b5ad
add esp, 4
mov eax, dword [esp + 0x90]
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], esi
cmp eax, edi
jmp 0x407ca0
cmp dword [esp + 0x58], edi
jb 0x407a18
mov eax, dword [esp + 0x44]
push eax
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x3c], edi
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], esi
mov byte [esp + 0x44], 0
jb 0x407a3c
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x90], edi
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], esi
mov byte [esp + 0x28], 0
jb 0x407a63
mov edx, dword [esp + 0x7c]
push edx
call fcn.0040b5ad
add esp, 4
mov al, 1
jmp 0x407cb6
mov ebx, 0xf
xor edi, edi
mov eax, 0x4176f8
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], edi
mov byte [esp + 0x60], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407a86
sub eax, edx
push eax
push 0x4176f8
lea ecx, [esp + 0x64]
call fcn.004018c7
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x5c]
push eax
mov byte [esp + 0x234], 0x13
call fcn.004061b0
mov eax, dword [esp + 0x74]
mov esi, 0x10
cmp eax, esi
jb 0x407ace
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x58], esi
jb 0x407ae1
mov edx, dword [esp + 0x44]
push edx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], edi
mov byte [esp + 0x44], 0
jb 0x407b01
mov eax, dword [esp + 0x28]
push eax
call fcn.0040b5ad
add esp, 4
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
cmp dword [esp + 0x90], esi
mov byte [esp + 0x28], 0
jb 0x407cb4
mov ecx, dword [esp + 0x7c]
push ecx
jmp 0x407cac
mov ebx, 0xf
xor edi, edi
mov eax, 0x4176e4
mov dword [esp + 0x74], ebx
mov dword [esp + 0x70], edi
mov byte [esp + 0x60], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407b41
sub eax, edx
push eax
push 0x4176e4
lea ecx, [esp + 0x64]
call fcn.004018c7
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x5c]
push edx
mov byte [esp + 0x234], 0x14
call fcn.004061b0
mov eax, dword [esp + 0x74]
mov esi, 0x10
cmp eax, esi
jb 0x407b89
mov eax, dword [esp + 0x60]
push eax
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x58], esi
jb 0x407b9c
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], edi
mov byte [esp + 0x44], 0
jb 0x407bbc
mov edx, dword [esp + 0x28]
push edx
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x90], esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], edi
mov byte [esp + 0x28], 0
jb 0x407cb4
mov eax, dword [esp + 0x7c]
push eax
jmp 0x407cac
mov esi, dword [esp + 0x18]
cmp dword [ebx], 0
mov edi, 0xf
je 0x407c4f
mov eax, 0x4176cc
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407c07
sub eax, edx
push eax
push 0x4176cc
lea ecx, [esp + 0x64]
call fcn.004018c7
lea ecx, [esp + 0x5c]
push ecx
mov ecx, esi
mov byte [esp + 0x234], 0x17
call fcn.004061b0
mov eax, dword [esp + 0x74]
mov esi, 0x10
cmp eax, esi
jb 0x407c54
mov edx, dword [esp + 0x60]
push edx
call fcn.0040b5ad
add esp, 4
jmp 0x407c54
mov esi, 0x10
cmp dword [esp + 0x58], esi
jb 0x407c67
mov eax, dword [esp + 0x44]
push eax
call fcn.0040b5ad
add esp, 4
cmp dword [esp + 0x3c], esi
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x407c8b
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0040b5ad
add esp, 4
mov eax, dword [esp + 0x90]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], 0
cmp eax, esi
mov byte [esp + 0x28], 0
jb 0x407cb4
mov edx, dword [esp + 0x7c]
push edx
call fcn.0040b5ad
add esp, 4
xor al, al
mov ecx, dword [esp + 0x228]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x224]
xor ecx, dword [esp + 0x234]
call fcn.0040c7a4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret 4