Function at 0x40abe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4e7ba5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1bc
mov al, byte [esp + 0xb]
push ebx
push ebp
xor ebp, ebp
push esi
push edi
mov dword [esp + 0x64], ecx
mov byte [esp + 0x20], al
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1d4], ebp
call fcn.004be1a0
lea ecx, [esp + 0x44]
mov byte [esp + 0x1d4], 1
call fcn.004be1a0
mov cl, byte [esp + 0x1b]
sub esp, 0x10
mov edx, esp
mov edi, 0x520010
xor eax, eax
mov dword [esp + 0x78], esp
mov byte [edx], cl
or ecx, 0xffffffff
mov dword [edx + 4], ebp
mov dword [edx + 8], ebp
mov dword [edx + 0xc], ebp
mov byte [esp + 0x1e4], 2
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x520010
mov ecx, edx
call fcn.004142c0
push ebp
lea ecx, [esp + 0x60]
call fcn.004ca360
push 0xff
lea edx, [esp + 0xd0]
mov ebx, 3
push 0x50f930
push edx
mov byte [esp + 0x1e0], bl
call fcn.004de8d6
mov al, byte [esp + 0x27]
push ecx
mov edx, esp
lea edi, [esp + 0xdc]
or ecx, 0xffffffff
mov dword [esp + 0x78], esp
mov byte [edx], al
xor eax, eax
mov dword [edx + 4], ebp
mov dword [edx + 8], ebp
mov dword [edx + 0xc], ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xe0]
push ecx
mov ecx, edx
call fcn.004142c0
sub esp, 0x10
lea edx, [esp + 0x3b]
mov ecx, esp
mov dword [esp + 0x58], esp
push edx
push 0x50f8e4
mov byte [esp + 0x1fc], 4
call fcn.00413bf0
mov byte [esp + 0x1f4], 5
sub esp, 0x10
lea eax, [esp + 0x92]
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
push 0x50f9a8
call fcn.00413bf0
sub esp, 0x10
lea edx, [esp + 0x83]
mov ecx, esp
mov dword [esp + 0x88], esp
push edx
push 0x520010
mov byte [esp + 0x21c], 6
call fcn.00413bf0
sub esp, 0x10
mov byte [esp + 0x224], 7
mov esi, esp
mov dword [esp + 0xc0], esp
push ecx
mov ecx, esp
mov dword [esp + 0x70], esp
push 6
push 0x50f9a0
call fcn.004be240
push esi
call fcn.004cfca0
sub esp, 8
mov byte [esp + 0x234], 8
mov esi, esp
mov dword [esp + 0x7c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x80], esp
push 6
push 0x50f9a0
call fcn.004be240
push esi
call fcn.004cfca0
add esp, 8
lea eax, [esp + 0xf4]
mov ecx, 0x5200a8
mov byte [esp + 0x234], bl
push eax
call fcn.004cb120
mov edx, dword [0x4f73d0]
mov cx, word [eax]
push edx
add eax, 4
mov word [esp + 0x50], cx
push ebp
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1e0], 9
call fcn.00413e90
mov eax, dword [esp + 0x9c]
mov byte [esp + 0x1d4], bl
cmp eax, ebp
je 0x40ae0d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40ae04
cmp al, 0xff
je 0x40ae04
dec al
mov byte [ecx], al
jmp 0x40ae0d
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0x4c]
call fcn.004c48d0
cmp ax, 2
jne 0x40aea8
mov eax, dword [esp + 0x54]
cmp eax, ebp
je 0x40ae45
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40ae3c
cmp al, 0xff
je 0x40ae3c
dec al
mov byte [ecx], al
jmp 0x40ae45
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
mov byte [esp + 0x1d4], 1
call fcn.004be2e0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d4], 0
call fcn.004be2e0
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
cmp esi, eax
mov dword [esp + 0x1d4], 0xffffffff
mov edi, eax
je 0x40c66b
mov ecx, esi
call fcn.00404da0
add esi, 0x1c
cmp esi, edi
jne 0x40ae90
mov esi, dword [esp + 0x24]
push esi
jmp 0x40c889
lea eax, [esp + 0x84]
lea ecx, [esp + 0x4c]
push eax
call fcn.004ca4a0
mov eax, dword [eax + 4]
cmp eax, ebp
jne 0x40aec5
mov eax, 0x4f7480
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xcc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x88]
and ecx, ebx
cmp eax, ebp
rep movsb byte es:[edi], byte [esi]
je 0x40af12
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40af09
cmp al, 0xff
je 0x40af09
dec al
mov byte [ecx], al
jmp 0x40af12
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0xcc]
push ecx
call fcn.004dea48
add esp, 4
mov byte [esp + 0x48], al
or eax, 0xffffffff
mov dword [esp + 0x6c], eax
mov dword [esp + 0x74], eax
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x2c], esp
push ecx
mov ecx, esp
mov dword [esp + 0x30], esp
push 6
push 0x50fb3c
call fcn.004be240
push esi
call fcn.004cfca0
mov ecx, dword [0x5200b4]
add esp, 8
call fcn.004d0780
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50fa04
call fcn.004be240
mov ecx, dword [0x5200b4]
call fcn.004d0980
mov al, byte [esp + 0x48]
push ebp
push ecx
test al, al
mov ecx, esp
jne 0x40af99
mov dword [esp + 0x24], esp
push 6
push 0x50fb34
jmp 0x40afa4
mov dword [esp + 0x24], esp
push 6
push 0x50fb2c
call fcn.004be240
mov ecx, dword [0x5200b4]
call fcn.004d0980
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50f9d4
call fcn.004be240
mov ecx, dword [0x5200b4]
call fcn.004d0980
mov edi, dword [esp + 0x48]
lea eax, [esp + 0xcc]
mov edx, edi
and edx, 0xff
push edx
push 0x50f930
push eax
call fcn.004de8d6
add esp, 8
mov ecx, esp
mov dword [esp + 0x20], esp
push 6
push 0x50f5c0
call fcn.004be240
sub esp, 0x10
lea edx, [esp + 0x57]
mov ecx, esp
mov dword [esp + 0x84], esp
lea eax, [esp + 0xe0]
push edx
push eax
mov byte [esp + 0x1f0], 0xa
call fcn.00413bf0
push ecx
mov byte [esp + 0x1ec], 0xb
mov ecx, esp
mov dword [esp + 0x50], esp
push 6
push 0x50f988
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
mov ecx, dword [0x5200b4]
call fcn.004d0f50
push 0xa
mov esi, eax
call fcn.004bb3e0
add esp, 4
cmp si, 2
je 0x40c311
movsx eax, si
sub eax, ebp
je 0x40b135
dec eax
jne 0x40af31
mov al, byte [esp + 0x48]
test al, al
jne 0x40b35e
movsx cx, byte [0x50d1ac]
push ecx
push 0x50d1ad
lea ecx, [esp + 0x44]
call fcn.004be740
lea edx, [esp + 0x44]
lea eax, [esp + 0x3c]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.004be1b0
call fcn.0047d320
add esp, 8
cmp ax, bp
push ebp
push 1
push ecx
mov ecx, esp
jg 0x40b107
mov dword [esp + 0x28], esp
push 6
push 0x50f76c
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x12
mov ecx, esp
mov dword [esp + 0x80], esp
push 6
push 0x50fb24
jmp 0x40b9af
mov dword [esp + 0x28], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x13
mov ecx, esp
mov dword [esp + 0x80], esp
push 6
push 0x50fb1c
jmp 0x40b9af
push 0xff
lea ecx, [esp + 0xd0]
push 0x50f930
push ecx
call fcn.004de8d6
mov al, byte [esp + 0x4f]
push ecx
mov edx, esp
lea edi, [esp + 0xdc]
or ecx, 0xffffffff
mov dword [esp + 0x2c], esp
mov byte [edx], al
xor eax, eax
mov dword [edx + 4], ebp
mov dword [edx + 8], ebp
mov dword [edx + 0xc], ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0xe0]
push ecx
mov ecx, edx
call fcn.004142c0
sub esp, 0x10
lea edx, [esp + 0x82]
mov ecx, esp
mov dword [esp + 0x90], esp
push edx
push 0x50f8e4
mov byte [esp + 0x1fc], 0xc
call fcn.00413bf0
sub esp, 0x10
lea eax, [esp + 0x4b]
mov ecx, esp
mov dword [esp + 0x68], esp
push eax
push 0x50f9a8
mov byte [esp + 0x20c], 0xd
call fcn.00413bf0
sub esp, 0x10
lea edx, [esp + 0xc3]
mov ecx, esp
mov dword [esp + 0x74], esp
push edx
push 0x520010
mov byte [esp + 0x21c], 0xe
call fcn.00413bf0
sub esp, 0x10
mov byte [esp + 0x224], 0xf
mov esi, esp
mov dword [esp + 0x80], esp
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push 6
push 0x50f9a0
call fcn.004be240
push esi
call fcn.004cfca0
sub esp, 8
mov byte [esp + 0x234], 0x10
mov esi, esp
mov dword [esp + 0x74], esp
push ecx
mov ecx, esp
mov dword [esp + 0x78], esp
push 6
push 0x50f9a0
call fcn.004be240
push esi
call fcn.004cfca0
add esp, 8
lea eax, [esp + 0x118]
mov byte [esp + 0x234], bl
push eax
mov ecx, 0x5200a8
call fcn.004cb120
mov edx, dword [0x4f73d0]
mov cx, word [eax]
push edx
add eax, 4
mov word [esp + 0x50], cx
push ebp
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1e0], 0x11
call fcn.00413e90
mov eax, dword [esp + 0xc0]
mov byte [esp + 0x1d4], bl
cmp eax, ebp
je 0x40b2b3
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40b2aa
cmp al, 0xff
je 0x40b2aa
dec al
mov byte [ecx], al
jmp 0x40b2b3
push ecx
call fcn.004de1a0
add esp, 4
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x4c]
push eax
mov dword [esp + 0xc4], ebp
mov dword [esp + 0xc8], ebp
mov dword [esp + 0xcc], ebp
call fcn.004ca4a0
mov edi, dword [eax + 4]
cmp edi, ebp
jne 0x40b2e5
mov edi, 0x4f7480
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xcc]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0xac]
and ecx, ebx
cmp eax, ebp
rep movsb byte es:[edi], byte [esi]
je 0x40b330
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40b327
cmp al, 0xff
je 0x40b327
dec al
mov byte [ecx], al
jmp 0x40b330
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0xcc]
mov dword [esp + 0xac], ebp
push ecx
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb8], ebp
call fcn.004dea48
add esp, 4
mov byte [esp + 0x48], al
jmp 0x40af31
mov eax, edi
and eax, 0xff
mov dword [esp + 0x38], eax
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push 6
push 0x50fb3c
call fcn.004be240
push esi
call fcn.004cfca0
mov ecx, dword [0x5200b4]
add esp, 8
call fcn.004d0780
xor ebp, ebp
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50fb14
call fcn.004be240
mov ecx, dword [0x5200b4]
call fcn.004d0980
push ebp
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f9d4
call fcn.004be240
mov ecx, dword [0x5200b4]
call fcn.004d0980
mov edx, dword [esp + 0x38]
lea eax, [esp + 0xcc]
push edx
push 0x50f930
push eax
call fcn.004de8d6
add esp, 8
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x50f5c0
call fcn.004be240
sub esp, 0x10
lea edx, [esp + 0x94]
mov ecx, esp
mov dword [esp + 0x44], esp
lea eax, [esp + 0xe0]
push edx
push eax
mov byte [esp + 0x1f0], 0x14
call fcn.00413bf0
push ecx
mov byte [esp + 0x1ec], 0x15
mov ecx, esp
mov dword [esp + 0x34], esp
push 6
push 0x50f988
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
cmp eax, ecx
mov dword [esp + 0x34], eax
mov edi, ecx
mov esi, eax
je 0x40b47b
push ebp
mov ecx, esi
call fcn.004159f0
add esi, 0x1c
cmp esi, edi
jne 0x40b46c
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x20]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x6c]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x70]
push 1
call fcn.0040a920
cmp ax, bp
je 0x40b983
jl 0x40c399
movsx edx, word [esp + 0x6c]
push edx
lea eax, [esp + 0xd0]
push 0x50f930
push eax
call fcn.004de8d6
add esp, 8
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x50f5c0
call fcn.004be240
sub esp, 0x10
lea edx, [esp + 0x77]
mov ecx, esp
mov dword [esp + 0x44], esp
lea eax, [esp + 0xe0]
push edx
push eax
mov byte [esp + 0x1f0], 0x18
call fcn.00413bf0
push ecx
mov byte [esp + 0x1ec], 0x19
mov ecx, esp
mov dword [esp + 0x34], esp
push 6
push 0x50fb0c
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
xor esi, esi
mov dword [esp + 0x34], ebp
mov edi, dword [esp + 0x24]
cmp edi, ebp
je 0x40b696
mov ecx, dword [esp + 0x28]
mov eax, 0x92492493
sub ecx, edi
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp esi, edx
jae 0x40b696
mov edx, dword [esp + 0x34]
push esi
lea ecx, [esp + 0x24]
cmp byte [edi + edx], 1
jne 0x40b61f
call fcn.00413da0
push ecx
add eax, 4
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004be1b0
mov ecx, dword [esp + 0x68]
call fcn.0047e790
cmp ax, bp
je 0x40b685
push ebp
push 0xffff
push esi
lea ecx, [esp + 0x2c]
call fcn.00413da0
push ecx
add eax, 8
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.004be1b0
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x1e4], 0x1a
call fcn.00413da0
sub esp, 0x10
add eax, 0xc
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.00413ad0
push esi
lea ecx, [esp + 0x40]
mov byte [esp + 0x1f4], 0x1b
call fcn.00413da0
push ecx
add eax, 4
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.004be1b0
mov ecx, dword [0x5200b0]
mov byte [esp + 0x1f4], bl
call fcn.004ce370
mov eax, dword [esp + 0x34]
inc esi
add eax, 0x1c
mov dword [esp + 0x34], eax
jmp 0x40b52f
call fcn.00413da0
push ecx
add eax, 8
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
call fcn.004be1b0
push esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x1dc], 0x1c
call fcn.00413da0
sub esp, 0x10
add eax, 0xc
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.00413ad0
push ecx
mov byte [esp + 0x1ec], 0x1d
mov ecx, esp
mov dword [esp + 0x34], esp
push 6
push 0x50f980
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
mov eax, dword [esp + 0x34]
inc esi
add eax, 0x1c
mov dword [esp + 0x34], eax
jmp 0x40b52f
mov ecx, dword [0x5200b4]
call fcn.004d0f50
push 0xa
mov esi, eax
call fcn.004bb3e0
add esp, 4
cmp si, 1
je 0x40c45e
cmp si, bp
jne 0x40b369
push 0xffff
lea eax, [esp + 0xd0]
push 0x50f930
push eax
call fcn.004de8d6
push ecx
mov cl, byte [esp + 0x73]
mov ebp, esp
xor esi, esi
lea edi, [esp + 0xdc]
xor eax, eax
mov byte [ebp], cl
or ecx, 0xffffffff
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov dword [esp + 0x24], esp
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 1
mov dword [esp + 0x48], ecx
push ecx
mov ecx, ebp
call fcn.004144a0
test al, al
je 0x40b73a
mov eax, dword [esp + 0x44]
mov edi, dword [ebp + 4]
mov ecx, eax
lea esi, [esp + 0xdc]
mov edx, ecx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, ebx
rep movsb byte es:[edi], byte [esi]
mov ecx, ebp
call fcn.00414480
xor esi, esi
sub esp, 0x10
lea eax, [esp + 0x9e]
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
push 0x50f8e4
mov byte [esp + 0x1fc], 0x1e
call fcn.00413bf0
sub esp, 0x10
lea edx, [esp + 0xb1]
mov ecx, esp
mov dword [esp + 0x4c], esp
push edx
push 0x50f9a8
mov byte [esp + 0x20c], 0x1f
call fcn.00413bf0
sub esp, 0x10
lea eax, [esp + 0xb9]
mov ecx, esp
mov dword [esp + 0xb0], esp
push eax
push 0x520010
mov byte [esp + 0x21c], 0x20
call fcn.00413bf0
sub esp, 0x10
mov byte [esp + 0x224], 0x21
mov edi, esp
mov dword [esp + 0x84], esp
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push 6
push 0x50fb14
call fcn.004be240
push edi
call fcn.004cfca0
sub esp, 8
mov byte [esp + 0x234], 0x22
mov edi, esp
mov dword [esp + 0x70], esp
push ecx
mov ecx, esp
mov dword [esp + 0x74], esp
push 6
push 0x50fb14
call fcn.004be240
push edi
call fcn.004cfca0
add esp, 8
lea ecx, [esp + 0xf4]
mov byte [esp + 0x234], bl
push ecx
mov ecx, 0x5200a8
call fcn.004cb120
mov ecx, dword [0x4f73d0]
mov dx, word [eax]
push ecx
add eax, 4
push esi
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1e0], 0x23
mov word [esp + 0x58], dx
call fcn.00413e90
mov eax, dword [esp + 0x9c]
mov byte [esp + 0x1d4], bl
cmp eax, esi
je 0x40b86d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40b864
cmp al, 0xff
je 0x40b864
dec al
mov byte [ecx], al
jmp 0x40b86d
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0x4c]
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], esi
call fcn.004c48d0
cmp ax, 2
je 0x40b369
lea edx, [esp + 0x84]
lea ecx, [esp + 0x4c]
push edx
call fcn.004ca4a0
mov edi, dword [eax + 4]
test edi, edi
jne 0x40b8b2
mov edi, 0x4f7480
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xcc]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x88]
and ecx, ebx
rep movsb byte es:[edi], byte [esi]
xor esi, esi
cmp eax, esi
je 0x40b8ff
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40b8f6
cmp al, 0xff
je 0x40b8f6
dec al
mov byte [ecx], al
jmp 0x40b8ff
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0xcc]
mov dword [esp + 0x88], esi
push ecx
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], esi
call fcn.004dea48
add esp, 4
mov dword [esp + 0x74], eax
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cmp esi, edi
mov ebp, esi
je 0x40b944
mov ecx, esi
call fcn.00404da0
add esi, 0x1c
cmp esi, edi
jne 0x40b936
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0x20]
lea eax, [esp + 0x6c]
push edx
push eax
push ecx
mov ecx, dword [esp + 0x70]
push 1
mov dword [esp + 0x38], ebp
call fcn.0040a920
test ax, ax
je 0x40bd3d
jl 0x40c4e6
cmp ax, 0xff
jne 0x40b9ca
push 0xa
call fcn.004bb3e0
add esp, 4
jmp 0x40b928
push ebp
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f76c
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x16
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50f9bc
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x1e4], bl
call fcn.004caf10
jmp 0x40af31
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x20], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50fb3c
call fcn.004be240
push esi
call fcn.004cfca0
mov ecx, dword [0x5200b4]
add esp, 8
call fcn.004d0780
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x50fb04
call fcn.004be240
mov ecx, dword [0x5200b4]
call fcn.004d0980
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x50f9d4
call fcn.004be240
mov ecx, dword [0x5200b4]
call fcn.004d0980
mov edx, dword [esp + 0x38]
lea eax, [esp + 0xcc]
push edx
push 0x50f930
push eax
call fcn.004de8d6
add esp, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x50f5c0
call fcn.004be240
sub esp, 0x10
lea edx, [esp + 0x96]
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0xe0]
push edx
push eax
mov byte [esp + 0x1f0], 0x26
call fcn.00413bf0
push ecx
mov byte [esp + 0x1ec], 0x27
mov ecx, esp
mov dword [esp + 0x48], esp
push 6
push 0x50f988
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
movsx ecx, word [esp + 0x6c]
push ecx
lea edx, [esp + 0xd0]
push 0x50f930
push edx
call fcn.004de8d6
add esp, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x50f5c0
call fcn.004be240
sub esp, 0x10
mov byte [esp + 0x1e8], 0x28
mov ecx, esp
lea eax, [esp + 0x8e]
mov dword [esp + 0x28], esp
lea edx, [esp + 0xe0]
push eax
push edx
call fcn.00413bf0
push ecx
mov byte [esp + 0x1ec], 0x29
mov ecx, esp
mov dword [esp + 0x48], esp
push 6
push 0x50fb0c
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
movsx eax, word [esp + 0x74]
push eax
lea ecx, [esp + 0xd0]
push 0x50f930
push ecx
call fcn.004de8d6
add esp, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x50f5c0
call fcn.004be240
sub esp, 0x10
lea edx, [esp + 0x90]
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0xe0]
push edx
push eax
mov byte [esp + 0x1f0], 0x2a
call fcn.00413bf0
push ecx
mov byte [esp + 0x1ec], 0x2b
mov ecx, esp
mov dword [esp + 0x48], esp
push 6
push 0x50fafc
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
xor esi, esi
xor ebp, ebp
mov edi, dword [esp + 0x24]
test edi, edi
je 0x40bd12
mov ecx, dword [esp + 0x28]
mov eax, 0x92492493
sub ecx, edi
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp esi, edx
jae 0x40bd12
mov al, byte [edi + ebp]
push esi
cmp al, 1
lea ecx, [esp + 0x24]
jne 0x40bca3
call fcn.00413da0
push ecx
add eax, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004be1b0
mov ecx, dword [esp + 0x68]
call fcn.0047e790
test ax, ax
je 0x40bd09
push 0
push 0xffff
push esi
lea ecx, [esp + 0x2c]
call fcn.00413da0
push ecx
add eax, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004be1b0
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x1e4], 0x2c
call fcn.00413da0
sub esp, 0x10
add eax, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00413ad0
push esi
lea ecx, [esp + 0x40]
mov byte [esp + 0x1f4], 0x2d
call fcn.00413da0
push ecx
add eax, 4
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.004be1b0
mov ecx, dword [0x5200b0]
mov byte [esp + 0x1f4], bl
call fcn.004ce370
inc esi
add ebp, 0x1c
jmp 0x40bbbd
call fcn.00413da0
push ecx
add eax, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004be1b0
push esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x1dc], 0x2e
call fcn.00413da0
sub esp, 0x10
add eax, 0xc
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00413ad0
push ecx
mov byte [esp + 0x1ec], 0x2f
mov ecx, esp
mov dword [esp + 0x48], esp
push 6
push 0x50f980
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
inc esi
add ebp, 0x1c
jmp 0x40bbbd
mov ecx, dword [0x5200b4]
call fcn.004d0f50
push 0xa
mov esi, eax
call fcn.004bb3e0
add esp, 4
cmp si, 1
je 0x40c5b8
test si, si
je 0x40bd87
jmp 0x40b928
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f76c
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x24
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50f9bc
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x1e4], bl
call fcn.004caf10
xor ebp, ebp
jmp 0x40af31
sub esp, 0x10
mov esi, esp
mov dword [esp + 0x20], esp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50fb3c
call fcn.004be240
push esi
call fcn.004cfca0
mov ecx, dword [0x5200b4]
add esp, 8
call fcn.004d0780
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x50faf4
call fcn.004be240
mov ecx, dword [0x5200b4]
call fcn.004d0980
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 6
push 0x50f9d4
call fcn.004be240
mov ecx, dword [0x5200b4]
call fcn.004d0980
mov edx, dword [esp + 0x38]
lea eax, [esp + 0xcc]
push edx
push 0x50f930
push eax
call fcn.004de8d6
add esp, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x50f5c0
call fcn.004be240
sub esp, 0x10
lea edx, [esp + 0x91]
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0xe0]
push edx
push eax
mov byte [esp + 0x1f0], 0x32
call fcn.00413bf0
push ecx
mov byte [esp + 0x1ec], 0x33
mov ecx, esp
mov dword [esp + 0x48], esp
push 6
push 0x50f988
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp esi, eax
mov ebp, esi
mov edi, eax
mov dword [esp + 0x34], esi
je 0x40bec6
push 1
lea ecx, [esi + 0xc]
mov byte [esp + 0x1d8], 0x35
call fcn.00414090
lea ecx, [esi + 8]
mov byte [esp + 0x1d4], 0x34
call fcn.004be2e0
lea ecx, [esi + 4]
mov byte [esp + 0x1d4], bl
call fcn.004be2e0
add esi, 0x1c
cmp esi, edi
mov dword [esp + 0x34], esi
jne 0x40be8a
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x68]
push edx
push eax
push 2
mov dword [esp + 0x38], ebp
call fcn.0040a920
test ax, ax
je 0x40c1c3
jl 0x40c671
movsx ecx, word [esp + 0x6c]
push ecx
lea edx, [esp + 0xd0]
push 0x50f930
push edx
call fcn.004de8d6
add esp, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x50f5c0
call fcn.004be240
sub esp, 0x10
lea eax, [esp + 0x8f]
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0xe0]
push eax
push edx
mov byte [esp + 0x1f0], 0x3a
call fcn.00413bf0
push ecx
mov byte [esp + 0x1ec], 0x3b
mov ecx, esp
mov dword [esp + 0x48], esp
push 6
push 0x50fb0c
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
movsx eax, word [esp + 0x74]
push eax
lea ecx, [esp + 0xd0]
push 0x50f930
push ecx
call fcn.004de8d6
add esp, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push 6
push 0x50f5c0
call fcn.004be240
sub esp, 0x10
lea edx, [esp + 0x93]
mov ecx, esp
mov dword [esp + 0x28], esp
lea eax, [esp + 0xe0]
push edx
push eax
mov byte [esp + 0x1f0], 0x3c
call fcn.00413bf0
push ecx
mov byte [esp + 0x1ec], 0x3d
mov ecx, esp
mov dword [esp + 0x48], esp
push 6
push 0x50fafc
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
xor esi, esi
xor ebp, ebp
mov edi, dword [esp + 0x24]
test edi, edi
je 0x40c14c
mov ecx, dword [esp + 0x28]
mov eax, 0x92492493
sub ecx, edi
imul ecx
add edx, ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
cmp esi, edx
jae 0x40c14c
mov al, byte [edi + ebp]
push esi
cmp al, 1
lea ecx, [esp + 0x24]
jne 0x40c0dd
call fcn.00413da0
push ecx
add eax, 4
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004be1b0
mov ecx, dword [esp + 0x68]
call fcn.0047e790
test ax, ax
je 0x40c143
push 0
push 0xffff
push esi
lea ecx, [esp + 0x2c]
call fcn.00413da0
push ecx
add eax, 8
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.004be1b0
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x1e4], 0x3e
call fcn.00413da0
sub esp, 0x10
add eax, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00413ad0
push esi
lea ecx, [esp + 0x40]
mov byte [esp + 0x1f4], 0x3f
call fcn.00413da0
push ecx
add eax, 4
mov ecx, esp
mov dword [esp + 0x50], esp
push eax
call fcn.004be1b0
mov ecx, dword [0x5200b0]
mov byte [esp + 0x1f4], bl
call fcn.004ce370
inc esi
add ebp, 0x1c
jmp 0x40bff7
call fcn.00413da0
push ecx
add eax, 8
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
call fcn.004be1b0
push esi
lea ecx, [esp + 0x28]
mov byte [esp + 0x1dc], 0x40
call fcn.00413da0
sub esp, 0x10
add eax, 0xc
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.00413ad0
push ecx
mov byte [esp + 0x1ec], 0x41
mov ecx, esp
mov dword [esp + 0x48], esp
push 6
push 0x50f980
call fcn.004be240
mov ecx, dword [0x5200b4]
mov byte [esp + 0x1ec], bl
call fcn.004d0d40
inc esi
add ebp, 0x1c
jmp 0x40bff7
mov ecx, dword [0x5200b4]
call fcn.004d0f50
push 0xa
mov esi, eax
call fcn.004bb3e0
add esp, 4
cmp si, 1
je 0x40c782
test si, si
jne 0x40bd87
push 0
push 4
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x44
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50faec
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x1e4], bl
call fcn.004caf10
cmp ax, bx
je 0x40c1ee
jmp 0x40bd87
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f76c
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x36
mov ecx, esp
mov dword [esp + 0x24], esp
jmp 0x40bd63
lea ecx, [esp + 0x68]
call fcn.004be1a0
movsx dx, byte [0x50d1c0]
push edx
push 0x50d1c1
lea ecx, [esp + 0x70]
mov byte [esp + 0x1dc], 0x45
call fcn.004be740
mov al, byte [esp + 0x48]
movsx dx, byte [0x50d1cc]
mov byte [0x50d1d0], al
mov eax, dword [esp + 0x74]
mov ecx, eax
push edx
sar ecx, 8
mov byte [0x50d1d1], cl
push 0x50d1cd
lea ecx, [esp + 0x44]
mov byte [0x50d1d2], al
call fcn.004be740
push 0x40180000
push 0
push 0x32
push 0x96
mov ecx, 0x520070
call fcn.004c1860
push 0
mov ecx, 0x520070
call fcn.004c2430
lea eax, [esp + 0x44]
lea edx, [esp + 0x68]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.004be1b0
call fcn.0047d320
add esp, 8
lea eax, [esp + 0x44]
lea edx, [esp + 0x3c]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.004be1b0
call fcn.0047d320
add esp, 8
mov ecx, 0x520070
push 1
call fcn.004c2430
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f634
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x46
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50fae4
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x1e4], 0x45
call fcn.004caf10
lea ecx, [esp + 0x68]
mov byte [esp + 0x1d4], bl
call fcn.004be2e0
xor ebp, ebp
jmp 0x40af31
mov eax, dword [esp + 0x54]
cmp eax, ebp
je 0x40c336
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40c32d
cmp al, 0xff
je 0x40c32d
dec al
mov byte [ecx], al
jmp 0x40c336
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
mov byte [esp + 0x1d4], 1
call fcn.004be2e0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d4], 0
call fcn.004be2e0
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
cmp esi, eax
mov dword [esp + 0x1d4], 0xffffffff
mov edi, eax
je 0x40c66b
mov ecx, esi
call fcn.00404da0
add esi, 0x1c
cmp esi, edi
jne 0x40c381
mov esi, dword [esp + 0x24]
push esi
jmp 0x40c889
push ebp
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f76c
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x17
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50f970
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x1e4], bl
call fcn.004caf10
mov eax, dword [esp + 0x54]
cmp eax, ebp
je 0x40c400
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40c3f7
cmp al, 0xff
je 0x40c3f7
dec al
mov byte [ecx], al
jmp 0x40c400
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
mov byte [esp + 0x1d4], 1
call fcn.004be2e0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d4], 0
call fcn.004be2e0
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
cmp esi, eax
mov dword [esp + 0x1d4], 0xffffffff
mov edi, eax
je 0x40c771
mov ecx, esi
call fcn.00404da0
add esi, 0x1c
cmp esi, edi
jne 0x40c44b
jmp 0x40c76d
mov eax, dword [esp + 0x54]
cmp eax, ebp
je 0x40c483
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40c47a
cmp al, 0xff
je 0x40c47a
dec al
mov byte [ecx], al
jmp 0x40c483
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x5c], ebp
mov byte [esp + 0x1d4], 1
call fcn.004be2e0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d4], 0
call fcn.004be2e0
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
cmp esi, eax
mov dword [esp + 0x1d4], 0xffffffff
mov edi, eax
je 0x40c66b
mov ecx, esi
call fcn.00404da0
add esi, 0x1c
cmp esi, edi
jne 0x40c4ce
mov esi, dword [esp + 0x24]
push esi
jmp 0x40c889
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f76c
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x25
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50f970
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x1e4], bl
call fcn.004caf10
mov eax, dword [esp + 0x54]
test eax, eax
je 0x40c54e
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40c545
cmp al, 0xff
je 0x40c545
dec al
mov byte [ecx], al
jmp 0x40c54e
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov byte [esp + 0x1d4], 1
call fcn.004be2e0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d4], 0
call fcn.004be2e0
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
cmp esi, eax
mov dword [esp + 0x1d4], 0xffffffff
mov edi, eax
je 0x40c771
mov ecx, esi
call fcn.00404da0
add esi, 0x1c
cmp esi, edi
jne 0x40c5a5
jmp 0x40c76d
mov eax, dword [esp + 0x54]
xor esi, esi
cmp eax, esi
je 0x40c5df
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40c5d6
cmp al, 0xff
je 0x40c5d6
dec al
mov byte [ecx], al
jmp 0x40c5df
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov byte [esp + 0x1d4], 1
call fcn.004be2e0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d4], 0
call fcn.004be2e0
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
or ebp, 0xffffffff
cmp esi, edi
mov dword [esp + 0x1d4], ebp
mov dword [esp + 0x38], esi
je 0x40c66b
mov bl, 0x30
push 1
lea ecx, [esi + 0xc]
mov dword [esp + 0x1d8], 0x31
call fcn.00414090
lea ecx, [esi + 8]
mov byte [esp + 0x1d4], bl
call fcn.004be2e0
lea ecx, [esi + 4]
mov dword [esp + 0x1d4], ebp
call fcn.004be2e0
add esi, 0x1c
cmp esi, edi
mov dword [esp + 0x38], esi
jne 0x40c629
mov esi, dword [esp + 0x24]
push esi
jmp 0x40c889
push 0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 6
push 0x50f76c
call fcn.004be240
push ecx
mov byte [esp + 0x1e4], 0x37
mov ecx, esp
mov dword [esp + 0x24], esp
push 6
push 0x50f970
call fcn.004be240
mov ecx, 0x5200a8
mov byte [esp + 0x1e4], bl
call fcn.004caf10
mov eax, dword [esp + 0x54]
test eax, eax
je 0x40c6d9
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40c6d0
cmp al, 0xff
je 0x40c6d0
dec al
mov byte [ecx], al
jmp 0x40c6d9
push ecx
call fcn.004de1a0
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov byte [esp + 0x1d4], 1
call fcn.004be2e0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d4], 0
call fcn.004be2e0
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
or ebp, 0xffffffff
cmp esi, edi
mov dword [esp + 0x1d4], ebp
mov dword [esp + 0x38], esi
je 0x40c771
mov bl, 0x38
push 1
lea ecx, [esi + 0xc]
mov dword [esp + 0x1d8], 0x39
call fcn.00414090
lea ecx, [esi + 8]
mov byte [esp + 0x1d4], bl
call fcn.004be2e0
lea ecx, [esi + 4]
mov dword [esp + 0x1d4], ebp
call fcn.004be2e0
add esi, 0x1c
cmp esi, edi
mov dword [esp + 0x38], esi
jne 0x40c72f
mov esi, dword [esp + 0x24]
push esi
call fcn.004de1a0
add esp, 4
xor ax, ax
jmp 0x40c895
mov eax, dword [esp + 0x54]
test eax, eax
je 0x40c7a7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x40c79e
cmp al, 0xff
je 0x40c79e
dec al
mov byte [ecx], al
jmp 0x40c7a7
push ecx
call fcn.004de1a0
add esp, 4
xor eax, eax
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov byte [esp + 0x1d4], 1
call fcn.004be2e0
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1d4], 0
call fcn.004be2e0
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
or ebp, 0xffffffff
cmp edi, eax
mov dword [esp + 0x1d4], ebp
mov ebx, eax
mov dword [esp + 0x38], edi
je 0x40c888
mov eax, dword [edi + 0x10]
lea esi, [edi + 0xc]
test eax, eax
mov dword [esp + 0x1d4], 0x43
je 0x40c84b
push eax
mov ecx, esi
call fcn.004145c0
cmp byte [eax], 0
je 0x40c838
mov eax, dword [esi + 4]
mov ecx, esi
push eax
call fcn.004145c0
cmp byte [eax], 0xff
je 0x40c838
mov ecx, dword [esi + 4]
push ecx
mov ecx, esi
call fcn.004145c0
dec byte [eax]
jmp 0x40c84b
mov edx, dword [esi + 0xc]
mov eax, dword [esi + 4]
add edx, 2
dec eax
push edx
push eax
mov ecx, esi
call fcn.0048c5f0
xor eax, eax
lea ecx, [edi + 8]
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov byte [esp + 0x1d4], 0x42
call fcn.004be2e0
lea ecx, [edi + 4]
mov dword [esp + 0x1d4], ebp
call fcn.004be2e0
add edi, 0x1c
cmp edi, ebx
mov dword [esp + 0x38], edi
jne 0x40c7f7
mov edi, dword [esp + 0x24]
push edi
call fcn.004de1a0
add esp, 4
mov ax, 1
mov ecx, dword [esp + 0x1cc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c8
ret