Function at 0x407960
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x468
mov eax, dword [0x46d040]
xor eax, esp
mov dword [esp + 0x464], eax
mov edx, dword [0x46ec98]
push ebx
push ebp
push esi
push edi
mov edi, 2
mov dword [esp + 0x50], ecx
lea ecx, [edi + 0x2e]
call fcn.00405ce0
mov ecx, eax
xor edx, edx
lea eax, [ecx + 8]
mov dword [esp + 0x14], ecx
xor ebp, ebp
mov esi, 0x26
mov dword [esp + 0x1c], esi
mov dword [ecx], 0x26
mov dword [ecx + 4], eax
mov word [eax + 0x26], dx
test byte [0x46dd0c], 1
mov ebx, dword [ecx + 4]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], ebp
jne 0x407abb
mov ecx, 0x46dd0c
lock bts dword [ecx], 0x1f
setb al
test al, al
jne 0x407b07
push 4
lea eax, [esp + 0x6c]
push eax
push 0xe
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x407a12
mov ax, word ds:[esp + 0x68]
test ax, ax
je 0x407a12
cmp word [esp + 0x6a], bp
jne 0x407a12
mov word [0x46dd14], ax
push 4
lea eax, [esp + 0x6c]
push eax
push 0xf
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x407a41
mov ax, word [esp + 0x68]
test ax, ax
je 0x407a41
cmp word [esp + 0x6a], bp
jne 0x407a41
mov word [0x46dd58], ax
cmp word [0x46dd14], 0x2e
je 0x407a5f
push 0x46542c
push 0
call fcn.0042923b
add esp, 8
mov dword [0x46ee34], eax
mov eax, 0x46dd0c
lock bts dword [eax], 0
setb al
test al, al
jne 0x407abb
mov esi, dword [0x46dd10]
test esi, esi
je 0x407a86
push 0
push esi
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov eax, 0xfffffffe
mov ecx, 0x46dd0c
lock xadd dword [ecx], eax
shr eax, 1
and eax, 0x7fff
sub eax, 1
jne 0x407ab6
test esi, esi
je 0x407ab6
push esi
call dword [sym.imp.ntdll.dll_NtClose]
mov dword [0x46dd10], ebp
mov esi, 0x26
mov dword [esp + 0x4c], 3
mov eax, dword [esp + 0x50]
dec edi
mov dword [esp + 0x5c], edi
mov edi, eax
add eax, 0x18
mov dword [esp + 0x30], edi
mov dword [esp + 0x50], eax
mov dword [esp + 0x44], ebp
mov edx, dword [edi]
mov eax, edx
and eax, 0x3f
mov dword [esp + 0x18], 0
mov dword [esp + 0x34], edx
cmp eax, 0xd
ja case.default.0x407b00
nop dword [eax]
jmp dword [eax*4 + 0x409040]
test byte [0x46dd0c], 1
jne 0x407abb
call fcn.00414d20
jmp 0x407abb
lea edi, [ebp + 2]
cmp esi, edi
jae 0x407b7c
mov edx, dword [0x46ec98]
lea eax, [esi + esi]
cmp eax, edi
mov ebx, edi
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
push ebp
mov dword [esi], ebx
mov dword [esi + 4], eax
mov word [eax + ebx], cx
mov ebx, dword [esp + 0x18]
push dword [ebx + 4]
push dword [esi + 4]
call fcn.00422f70
add esp, 0xc
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x407b70
call fcn.00405dc0
mov eax, dword [esi + 4]
shr ebp, 1
mov dword [esp + 0x14], esi
lea ebx, [eax + ebp*2]
mov ecx, dword [esp + 0x30]
mov ebp, edi
mov ax, word [ecx + 0x10]
mov word [ebx], ax
add ebx, 2
jmp 0x408ec9
mov ecx, dword [edi + 0x10]
add ecx, ebp
cmp esi, ecx
jae 0x407bfa
mov edx, dword [0x46ec98]
lea eax, [esi + esi]
cmp eax, ecx
mov ebx, ecx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
push ebp
mov dword [esi], ebx
mov dword [esi + 4], eax
mov word [eax + ebx], cx
mov ebx, dword [esp + 0x18]
push dword [ebx + 4]
push dword [esi + 4]
call fcn.00422f70
add esp, 0xc
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x407bec
call fcn.00405dc0
mov eax, dword [esi + 4]
mov ecx, ebp
shr ecx, 1
mov dword [esp + 0x14], esi
lea ebx, [eax + ecx*2]
push dword [edi + 0x10]
push dword [edi + 0x14]
push ebx
call fcn.00422f70
mov eax, dword [edi + 0x10]
add esp, 0xc
shr eax, 1
add ebp, dword [edi + 0x10]
lea ebx, [ebx + eax*2]
jmp 0x408ec9
mov ecx, dword ds:[edi + 0x10]
call fcn.00406640
lea esi, [eax + eax]
mov eax, dword [esp + 0x1c]
add ebp, esi
cmp eax, ebp
jae 0x407c9b
mov edx, dword [0x46ec98]
add eax, eax
cmp eax, ebp
mov ebx, ebp
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], eax
mov word [eax + ebx], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.00422f70
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x407c8b
call fcn.00405dc0
mov eax, dword [edi + 4]
shr ebx, 1
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x30]
lea ebx, [eax + ebx*2]
push esi
push dword [edi + 0x10]
push ebx
call fcn.00422f70
add esp, 0xc
shr esi, 1
lea ebx, [ebx + esi*2]
jmp 0x408ec9
cmp edx, 3
jne 0x407cbf
mov ebp, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
jmp 0x407cd0
mov ebp, dword [edi + 0x10]
mov esi, ebp
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x407cc7
sub esi, ecx
push esi
push ebp
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeSize]
nop dword [eax]
test eax, eax
js 0x407d93
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
lfence
mov eax, dword [esp + 0x48]
add ecx, eax
cmp edx, ecx
jae 0x407d6d
lea eax, [edx + edx]
mov ebx, ecx
mov edx, dword [0x46ec98]
cmp eax, ecx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], eax
mov word [eax + ebx], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.00422f70
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x407d57
call fcn.00405dc0
mov eax, dword [edi + 4]
mov ecx, ebx
shr ecx, 1
mov dword [esp + 0x14], edi
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x2c], ebx
push esi
push ebp
push 0
push eax
push ebx
call dword [sym.imp.ntdll.dll_RtlMultiByteToUnicodeN]
test eax, eax
js 0x407d93
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x10]
shr eax, 1
add ebp, dword [esp + 0x48]
lea ebx, [ebx + eax*2]
jmp 0x408ec9
mov ebp, dword [esp + 0x10]
jmp case.default.0x407b00
mov ecx, 0x10
mov eax, edi
mov eax, dword [eax + ecx]
mov ecx, eax
shr ecx, 0x1f
mov dword [esp + 0x18], ecx
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
mov edx, dword [esp + 0x34]
jmp 0x407dbf
mov ecx, dword [edi + 0x10]
mov dword [esp + 0x28], 0xa
test edx, 0x100
je 0x407de1
mov al, byte [edi + 0xa]
cmp al, 2
jb 0x407de1
cmp al, 0x45
ja 0x407de1
movzx eax, al
mov dword [esp + 0x28], eax
test edx, 0x20000000
lea ebp, [esp + 0x46e]
mov edi, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov eax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
cmovne edi, eax
xor esi, esi
mov dword [esp + 0x24], edi
test ecx, ecx
je 0x407ea2
test edx, 0x10000
je 0x407e7d
xor edi, edi
mov eax, ecx
xor edx, edx
div dword [esp + 0x28]
inc edi
inc esi
mov ecx, eax
mov eax, dword [esp + 0x24]
movsx ax, byte [eax + edx]
mov word [ebp], ax
sub ebp, 2
cmp edi, 3
jne 0x407e64
test ecx, ecx
je 0x407e68
movzx eax, word [0x46dd58]
xor edx, edx
mov word [ebp], ax
mov edi, 1
mov eax, ecx
div dword [esp + 0x28]
mov ecx, eax
mov eax, dword [esp + 0x24]
movsx eax, byte [edx + eax]
mov word [ebp - 2], ax
add ebp, 0xfffffffc
add esi, 2
test ecx, ecx
jne 0x407e13
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x18]
xor ecx, ecx
test edi, edi
je 0x407ebb
mov ecx, 1
jmp 0x407ec9
mov ebx, dword [esp + 0x28]
mov eax, ecx
xor edx, edx
div ebx
inc esi
mov ecx, eax
movsx ax, byte [edi + edx]
mov word [ebp], ax
sub ebp, 2
test ecx, ecx
jne 0x407e81
mov ebx, dword ds:[esp + 0x2c]
jmp 0x407e68
mov eax, 0x30
lea ebp, [esp + 0x46c]
mov word [esp + 0x46e], ax
lea esi, [eax - 0x2f]
jmp 0x407e6c
test edx, 0x20000
mov eax, 1
cmovne ecx, eax
and edx, 0x50000
cmp edx, 0x40000
jne 0x407ef9
mov eax, dword [esp + 0x30]
movzx edx, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edx
jae 0x407ef9
mov eax, edx
or edi, 4
sub eax, ecx
mov dword [esp + 0x18], edi
sub eax, esi
mov dword [esp + 0x60], eax
add ecx, eax
lea eax, [ecx + esi]
add ebp, 2
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
cmp eax, ecx
jae 0x407f77
mov edx, dword [0x46ec98]
add eax, eax
cmp eax, ecx
mov ebx, ecx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], eax
mov word [eax + ebx], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.00422f70
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x407f6b
call fcn.00405dc0
mov eax, dword [edi + 4]
shr ebx, 1
mov dword [esp + 0x14], edi
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x18]
test al, 1
je 0x407f86
mov ecx, 0x2d
jmp 0x407f97
mov ecx, dword [esp + 0x30]
test dword [ecx], 0x20000
je 0x407f9d
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
nop dword [eax]
test al, 4
je 0x407fc1
mov edx, dword [esp + 0x60]
test edx, edx
je 0x407fbe
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea ebx, [ebx + edx*2]
add esi, esi
push esi
push ebp
push ebx
call fcn.00422f70
mov ebp, dword [esp + 0x2c]
add esp, 0xc
add ebx, esi
jmp 0x408ec9
mov ecx, dword [edi + 0x14]
mov esi, dword [edi + 0x10]
mov dword [esp + 0x40], esi
mov dword [esp + 0x28], ecx
test ecx, ecx
jg 0x408010
jl 0x407ff1
test esi, esi
jae 0x408010
neg esi
mov dword [esp + 0x18], 1
adc ecx, 0
neg ecx
jmp 0x408008
mov esi, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x40], esi
mov ebp, dword [esp + 0x34]
mov edx, 0xa
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], 0
test ebp, 0x100
je 0x408062
mov al, byte ds:[edi + 0xa]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], 0
cmp al, 2
jb 0x408062
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], 0
cmp al, 0x45
ja 0x408062
movzx eax, al
cdq
mov dword [esp + 0x38], edx
mov edx, eax
mov dword [esp + 0x3c], eax
test ebp, 0x20000000
mov eax, str.0123456789abcdefghijklmnopqrstuvwxyz_________._:_________
mov ebp, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ_________._:_________
cmovne eax, ebp
xor edi, edi
mov dword [esp + 0x20], eax
lea ebp, [esp + 0x46e]
mov eax, esi
or eax, ecx
je 0x40817e
test dword [esp + 0x34], 0x10000
je 0x40812b
xor eax, eax
mov dword [esp + 0x2c], eax
push dword [esp + 0x38]
push edx
push ecx
push esi
call fcn.0043edc0
push dword [esp + 0x38]
mov esi, eax
mov eax, dword [esp + 0x40]
push eax
push dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
push eax
call fcn.0043ed50
mov dword [esp + 0x40], eax
inc edi
mov eax, dword [esp + 0x20]
mov ecx, edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], edi
movsx ax, byte [eax + esi]
mov esi, dword [esp + 0x40]
mov word [ebp], ax
sub ebp, 2
mov eax, dword [esp + 0x2c]
inc eax
cmp eax, 3
jne 0x408110
mov eax, esi
or eax, ecx
je 0x40819b
mov ax, word [0x46dd58]
mov edx, dword [esp + 0x3c]
mov word [ebp], ax
sub ebp, 2
inc edi
jmp 0x40809a
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
mov eax, esi
or eax, ecx
mov dword [esp + 0x24], edi
jne 0x4080a0
jmp 0x40819b
mov ebx, dword [esp + 0x38]
nop
push ebx
push edx
push ecx
push esi
call fcn.0043edc0
push ebx
mov esi, eax
mov eax, dword [esp + 0x40]
push eax
push dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
push eax
call fcn.0043ed50
mov dword [esp + 0x40], eax
mov ecx, edx
mov eax, dword [esp + 0x20]
inc edi
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
movsx ax, byte [eax + esi]
mov esi, dword [esp + 0x40]
mov word [ebp], ax
mov eax, esi
sub ebp, 2
or eax, ecx
jne 0x408130
mov ebx, dword [esp + 0x2c]
jmp 0x408197
mov eax, 0x30
lea ebp, [esp + 0x46c]
mov word [esp + 0x46e], ax
mov edi, 1
mov dword [esp + 0x24], edi
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x4081ae
mov ecx, 1
jmp 0x4081bb
test eax, 0x20000
mov edx, 1
cmovne ecx, edx
and eax, 0x50000
cmp eax, 0x40000
jne 0x4081e7
mov eax, dword [esp + 0x30]
movzx edx, word [eax + 6]
lea eax, [ecx + edi]
cmp eax, edx
jae 0x4081e7
or dword [esp + 0x18], 4
mov eax, edx
sub eax, ecx
sub eax, edi
mov dword [esp + 0x64], eax
add ecx, eax
lea eax, ds:[ecx + edi]
add ebp, 2
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + eax*2]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
cmp eax, ecx
jae 0x40826b
mov edx, dword [0x46ec98]
add eax, eax
cmp eax, ecx
mov ebx, ecx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
mov dword [esi], ebx
mov dword [esi + 4], eax
mov word [ebx + eax], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [esi + 4]
call fcn.00422f70
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40825f
call fcn.00405dc0
mov eax, dword [esi + 4]
shr ebx, 1
mov dword [esp + 0x14], esi
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0x18]
test al, 1
je 0x40827a
mov ecx, 0x2d
jmp 0x40828b
mov ecx, dword [esp + 0x30]
test dword [ecx], 0x20000
je 0x408291
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4082b6
mov edx, dword [esp + 0x64]
test edx, edx
je 0x4082b3
mov ecx, edx
mov eax, 0x300030
shr ecx, 1
mov edi, ebx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [esp + 0x24]
lea ebx, [ebx + edx*2]
lea esi, ds:[edi + edi]
push esi
push ebp
push ebx
call fcn.00422f70
mov ebp, dword [esp + 0x2c]
add esp, 0xc
add ebx, esi
jmp 0x408ec9
mov dword ds:[esp + 0x18], 0
test dl, 0x40
je 0x4082f8
movzx edx, word [edi + 4]
cmp edx, 0xa2
jbe 0x4082fd
mov edx, 0xa2
jmp 0x4082fd
mov edx, 6
mov esi, dword [esp + 0x34]
lea ebp, [esp + 0x71]
movss xmm0, dword [edi + 0x10]
sub esp, 8
mov eax, ebp
mov ecx, esi
push eax
call fcn.00419d00
test al, al
jne 0x408322
mov byte ds:[esp + 0x71], al
jmp 0x408373
mov edx, dword [0x46ee34]
test edx, edx
je 0x40834d
mov al, byte [esp + 0x71]
lea ecx, [esp + 0x71]
test al, al
je 0x40834d
cmp al, 0x2e
je 0x408346
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x408338
jmp 0x40834d
mov al, byte [0x46dd14]
mov byte [ecx], al
test esi, 0x20000000
je 0x408373
lea eax, [esp + 0x71]
test edx, edx
je 0x40836a
push edx
push eax
call fcn.004289d7
add esp, 8
jmp 0x408373
push eax
call fcn.0042897b
add esp, 4
mov edi, dword ds:[edi]
test edi, 0x8000
je 0x4083fe
mov al, byte [esp + 0x71]
lea ecx, [esp + 0x71]
mov ah, byte [0x46dd14]
test al, al
je 0x4083ac
nop
cmp al, ah
je 0x4083ac
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4083a0
mov al, byte [ecx]
inc ecx
test al, al
je 0x4083fe
mov al, byte [ecx]
test al, al
je 0x4083d0
nop dword [eax]
cmp al, 0x65
je 0x4083d0
cmp al, 0x45
je 0x4083d0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4083c0
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x4083e8
nop word [eax + eax]
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x4083e0
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x4083f0
lea esi, [esp + 0x71]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x408405
sub esi, ecx
cmp byte [esp + 0x71], 0x2d
jne 0x408422
mov edx, 1
lea ebp, [esp + 0x72]
dec esi
jmp 0x408434
mov edx, dword [esp + 0x18]
test edi, 0x20000
mov eax, 2
cmovne edx, eax
mov eax, edi
mov dword [esp + 0x18], edx
and eax, 0x13000
cmp eax, 0x10000
jne 0x4085c5
mov al, byte [ebp]
mov edi, ebp
sub al, 0x30
cmp al, 0xa
jae 0x408464
mov al, byte ds:[edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x408456
mov eax, edi
sub eax, ebp
mov dword [esp + 0x24], eax
lea ecx, [eax + 2]
mov dword [esp + 0x20], ecx
je 0x408483
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x408489
xor eax, eax
mov dword [esp + 0x20], ecx
lea ecx, [eax + esi]
mov dword [esp + 0x28], eax
add ecx, ecx
cmp dword [esp + 0x18], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, ecx
jae 0x40851b
add eax, eax
mov edx, ecx
cmp eax, ecx
cmovae edx, eax
mov dword [esp + 0x1c], edx
lea ecx, [edx + 0xa]
mov edx, dword [0x46ec98]
call fcn.00405ce0
mov edx, dword [esp + 0x1c]
mov ebx, eax
push dword [esp + 0x10]
lea eax, [ebx + 8]
xor ecx, ecx
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov word [edx + eax], cx
mov eax, dword [esp + 0x18]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00422f70
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x40850b
call fcn.00405dc0
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x14], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x20]
xor edx, edx
div dword [esp + 0x4c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
test al, 1
je 0x408538
mov eax, 0x2d
jmp 0x408541
test al, 2
je 0x408547
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40858c
nop
movsx ax, byte [ebp]
dec ecx
inc ebp
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x408584
test ecx, ecx
je 0x408588
movzx eax, word [0x46dd58]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [ebp]
mov word [ebx + 2], ax
add ebx, 4
inc ebp
test ecx, ecx
jne 0x408550
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x18], 0
mov ecx, ebx
mov ebp, dword [esp + 0x10]
je 0x40859c
add ebp, 2
mov edx, esi
sub edx, eax
mov eax, dword [esp + 0x28]
add eax, esi
push ecx
mov ecx, edi
lea ebx, [ebx + edx*2]
lea ebp, [ebp + eax*2]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x14], ebp
call fcn.00406f80
nop dword [eax]
jmp case.default.0x407b00
xor ecx, ecx
test edx, edx
setne cl
mov edx, ecx
test edi, 0x40000
je 0x4085f7
mov eax, dword [esp + 0x30]
movzx edi, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edi
jae 0x4085f7
or dword [esp + 0x18], 4
mov eax, edi
sub eax, ecx
sub eax, esi
mov dword [esp + 0x54], eax
lea edx, [ecx + eax]
mov ecx, dword [esp + 0x10]
lea eax, [edx + esi]
lea edx, [ecx + eax*2]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
cmp eax, edx
jae 0x408678
add eax, eax
mov ebx, edx
cmp eax, edx
mov edx, dword [0x46ec98]
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], eax
mov word [ebx + eax], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.00422f70
mov ecx, dword ds:[esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x408668
call fcn.00405dc0
mov eax, dword [edi + 4]
mov edx, dword [esp + 0x20]
shr ebx, 1
mov dword [esp + 0x14], edi
lea ebx, [eax + ebx*2]
mov eax, dword ds:[esp + 0x18]
test al, 1
je 0x40868b
mov ecx, 0x2d
jmp 0x408694
test al, 2
je 0x40869a
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
test al, 4
je 0x4086bf
mov eax, dword [esp + 0x54]
test eax, eax
je 0x4086bc
mov ecx, eax
mov edi, ebx
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [esp + 0x54]
lea ebx, [ebx + eax*2]
mov ecx, ebx
mov dword [esp + 0x10], edx
mov edi, ebp
lea ebx, [ebx + esi*2]
mov ebp, dword [esp + 0x10]
mov edx, esi
push ecx
mov ecx, edi
mov dword [esp + 0x30], ebx
call fcn.00406f80
nop dword [eax]
jmp case.default.0x407b00
mov dword [esp + 0x18], 0
test dl, 0x40
je 0x408705
movzx edx, word [edi + 4]
cmp edx, 0xa2
jbe 0x40870a
mov edx, 0xa2
jmp 0x40870a
mov edx, 6
movsd xmm0, qword [edi + 0x10]
lea ebp, [esp + 0x71]
mov esi, dword [esp + 0x34]
sub esp, 0x10
mov eax, ebp
mov ecx, esi
movsd qword [esp + 8], xmm0
push eax
call fcn.00419f20
test al, al
jne 0x408734
mov byte [esp + 0x71], al
jmp 0x40878b
mov edx, dword [0x46ee34]
test edx, edx
je 0x408765
mov al, byte [esp + 0x71]
lea ecx, [esp + 0x71]
test al, al
je 0x408765
nop word [eax + eax]
cmp al, 0x2e
je 0x40875e
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x408750
jmp 0x408765
mov al, byte [0x46dd14]
mov byte [ecx], al
test esi, 0x20000000
je 0x40878b
lea eax, [esp + 0x71]
test edx, edx
je 0x408782
push edx
push eax
call fcn.004289d7
add esp, 8
jmp 0x40878b
push eax
call fcn.0042897b
add esp, 4
mov edi, dword [edi]
test edi, 0x8000
je 0x40880e
mov al, byte [esp + 0x71]
lea ecx, [esp + 0x71]
mov ah, byte [0x46dd14]
test al, al
je 0x4087bc
nop dword [eax + eax]
cmp al, ah
je 0x4087bc
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4087b0
mov al, byte ds:[ecx]
inc ecx
test al, al
je 0x40880e
mov al, byte [ecx]
test al, al
je 0x4087e4
nop word [eax + eax]
cmp al, 0x65
je 0x4087e4
cmp al, 0x45
je 0x4087e4
mov al, byte ds:[ecx + 1]
inc ecx
test al, al
jne 0x4087d0
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x4087f8
nop
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x4087f0
cmp al, ah
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x408800
lea esi, [esp + 0x71]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x408815
sub esi, ecx
cmp byte [esp + 0x71], 0x2d
jne 0x408831
mov edx, 1
lea ebp, [esp + 0x72]
dec esi
jmp 0x408843
mov edx, dword [esp + 0x18]
test edi, 0x20000
mov eax, 2
cmovne edx, eax
mov eax, edi
mov dword [esp + 0x18], edx
and eax, 0x13000
cmp eax, 0x10000
jne 0x4089a5
mov al, byte [ebp]
mov edi, ebp
sub al, 0x30
cmp al, 0xa
jae 0x40886e
mov al, byte [edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x408864
mov eax, edi
sub eax, ebp
mov dword [esp + 0x24], eax
lea ecx, [eax + 2]
mov dword [esp + 0x20], ecx
je 0x40888d
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x408893
xor eax, eax
mov dword [esp + 0x20], ecx
lea ecx, [eax + esi]
mov dword [esp + 0x28], eax
add ecx, ecx
cmp dword [esp + 0x18], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, ecx
jae 0x408925
add eax, eax
mov edx, ecx
cmp eax, ecx
cmovae edx, eax
mov dword [esp + 0x1c], edx
lea ecx, [edx + 0xa]
mov edx, dword [0x46ec98]
call fcn.00405ce0
mov edx, dword [esp + 0x1c]
mov ebx, eax
push dword [esp + 0x10]
lea eax, [ebx + 8]
xor ecx, ecx
mov dword [ebx + 4], eax
mov dword [ebx], edx
mov word [edx + eax], cx
mov eax, dword [esp + 0x18]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00422f70
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x408915
call fcn.00405dc0
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x14], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x20]
xor edx, edx
div dword [esp + 0x4c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
test al, 1
je 0x408942
mov eax, 0x2d
jmp 0x40894b
test al, 2
je 0x408951
mov eax, 0x2b
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x24]
test eax, eax
je 0x40858c
nop dword [eax]
movsx ax, byte [ebp]
dec ecx
inc ebp
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x408998
test ecx, ecx
je 0x408588
movzx eax, word [0x46dd58]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [ebp]
mov word [ebx + 2], ax
add ebx, 4
inc ebp
test ecx, ecx
jne 0x408960
nop dword [eax]
jmp 0x408588
xor ecx, ecx
test edx, edx
setne cl
mov edx, ecx
test edi, 0x40000
je 0x4089d7
mov eax, dword [esp + 0x30]
movzx edi, word [eax + 6]
lea eax, [ecx + esi]
cmp eax, edi
jae 0x4089d7
or dword [esp + 0x18], 4
mov eax, edi
sub eax, ecx
sub eax, esi
mov dword [esp + 0x58], eax
lea edx, [ecx + eax]
mov ecx, dword [esp + 0x10]
lea eax, [edx + esi]
lea edx, [ecx + eax*2]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
cmp eax, edx
jae 0x408a5a
add eax, eax
mov ebx, edx
cmp eax, edx
mov edx, dword [0x46ec98]
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
mov dword [edi], ebx
mov dword [edi + 4], eax
mov word [ebx + eax], cx
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
push ebx
push dword [eax + 4]
push dword [edi + 4]
call fcn.00422f70
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x408a4a
call fcn.00405dc0
mov eax, dword [edi + 4]
mov edx, dword [esp + 0x20]
shr ebx, 1
mov dword [esp + 0x14], edi
lea ebx, [eax + ebx*2]
mov eax, dword ds:[esp + 0x18]
test al, 1
je 0x408a6b
mov ecx, 0x2d
jmp 0x408a74
test al, 2
je 0x408a7a
mov ecx, 0x2b
mov word [ebx], cx
add ebx, 2
nop word [eax + eax]
test al, 4
je 0x4086bf
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4086bc
mov ecx, eax
mov edi, ebx
shr ecx, 1
mov eax, 0x300030
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [esp + 0x58]
jmp 0x4086bc
mov eax, dword [esp + 0x30]
xor ebp, ebp
mov edi, dword [edi + 0x10]
mov ecx, edi
mov dword [esp + 0x18], ebp
mov esi, dword [eax + 0x14]
mov edx, esi
call fcn.004406d0
or edi, esi
jne 0x408b4e
mov ebp, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
lea edi, [ebp + 2]
cmp eax, edi
jae 0x408b3c
mov edx, dword [0x46ec98]
add eax, eax
cmp eax, edi
mov ebx, edi
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov esi, eax
xor ecx, ecx
lea eax, [esi + 8]
push ebp
mov dword [esi], ebx
mov dword [esi + 4], eax
mov word [ebx + eax], cx
mov ebx, dword [esp + 0x18]
push dword [ebx + 4]
push dword [esi + 4]
call fcn.00422f70
add esp, 0xc
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x408b30
call fcn.00405dc0
mov eax, dword [esi + 4]
shr ebp, 1
mov dword [esp + 0x14], esi
lea ebx, [eax + ebp*2]
mov eax, 0x30
mov ebp, edi
mov word [ebx], ax
add ebx, 2
jmp 0x408ec9
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
test ecx, 0x100
je 0x408b64
movzx eax, byte [edx + 0xa]
jmp 0x408b67
or eax, 0xffffffff
movsd xmm1, qword [0x46a0b8]
comisd xmm0, xmm1
jb 0x408b98
movsd xmm2, qword [0x46a0a8]
nop dword [eax]
cmp ebp, 7
jae 0x408b94
cmp ebp, eax
jae 0x408b94
mulsd xmm0, xmm2
inc ebp
comisd xmm0, xmm1
jae 0x408b80
mov dword [esp + 0x18], ebp
test cl, 0x40
je 0x408ba3
movzx eax, word [edx + 4]
jmp 0x408ba8
mov eax, 2
movzx edx, ax
lea esi, [esp + 0x71]
cmp edx, 0xa2
mov dword [esp + 0x24], 0
mov eax, 0xa2
mov dword [esp + 0x20], esi
cmova edx, eax
mov ecx, 0x1804c
sub esp, 0x10
mov eax, esi
movsd qword [esp + 8], xmm0
push eax
call fcn.00419f20
nop
test al, al
jne 0x408bec
xor dl, dl
mov byte [esp + 0x71], dl
jmp 0x408c20
cmp dword [0x46ee34], 0
mov dl, byte [esp + 0x71]
je 0x408c20
lea ecx, ds:[esp + 0x71]
test dl, dl
je 0x408c20
mov al, dl
cmp al, 0x2e
je 0x408c14
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x408c06
jmp 0x408c20
mov ax, word [0x46dd14]
mov byte [ecx], al
mov dl, byte [esp + 0x71]
lea ecx, [esp + 0x71]
test dl, dl
je 0x408c44
mov al, dl
nop word [eax + eax]
cmp al, byte [0x46dd14]
je 0x408c44
mov al, byte ds:[ecx + 1]
inc ecx
test al, al
jne 0x408c30
mov al, byte [ecx]
inc ecx
test al, al
je 0x408c9a
mov al, byte [ecx]
test al, al
je 0x408c64
cmp al, 0x65
je 0x408c64
cmp al, 0x45
je 0x408c64
mov al, byte ds:[ecx + 1]
inc ecx
test al, al
jne 0x408c51
mov al, byte [ecx - 1]
mov esi, ecx
dec ecx
cmp al, 0x30
jne 0x408c78
nop
mov al, byte [ecx - 1]
dec ecx
cmp al, 0x30
je 0x408c70
cmp al, byte [0x46dd14]
lea edx, [ecx - 1]
cmovne edx, ecx
mov al, byte [esi]
lea edx, [edx + 1]
mov byte [edx], al
lea esi, [esi + 1]
test al, al
jne 0x408c84
mov dl, byte [esp + 0x71]
mov esi, dword [esp + 0x20]
lea ebp, [esp + 0x71]
lea ecx, [ebp + 1]
mov al, byte [ebp]
inc ebp
test al, al
jne 0x408ca1
sub ebp, ecx
cmp dl, 0x2d
jne 0x408cbd
mov dword [esp + 0x24], 1
lea esi, [esp + 0x72]
dec ebp
mov al, byte [esi]
mov edi, esi
sub al, 0x30
cmp al, 0xa
jae 0x408cd1
mov al, byte [edi + 1]
inc edi
sub al, 0x30
cmp al, 0xa
jb 0x408cc7
mov eax, edi
sub eax, esi
mov dword [esp + 0x28], eax
lea ecx, [eax + 2]
mov dword [esp + 0x20], ecx
je 0x408cf0
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 1
dec eax
jmp 0x408cf6
xor eax, eax
mov dword [esp + 0x20], ecx
lea ecx, [eax + ebp]
mov dword [esp + 0x38], eax
add ecx, ecx
cmp dword [esp + 0x24], 0
lea eax, [ecx + 2]
cmove eax, ecx
mov ecx, dword [esp + 0x10]
add ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, ecx
jae 0x408d88
add eax, eax
mov edx, ecx
cmp eax, ecx
cmovae edx, eax
mov dword [esp + 0x1c], edx
lea ecx, [edx + 0xa]
mov edx, dword [0x46ec98]
call fcn.00405ce0
mov ecx, dword [esp + 0x1c]
mov ebx, eax
push dword [esp + 0x10]
lea eax, [ebx + 8]
xor edx, edx
mov dword [ebx + 4], eax
mov dword [ebx], ecx
mov word [ecx + eax], dx
mov eax, dword [esp + 0x18]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00422f70
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x408d78
call fcn.00405dc0
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx + 4]
shr ecx, 1
mov dword [esp + 0x14], ebx
lea ebx, [eax + ecx*2]
mov eax, dword [esp + 0x20]
xor edx, edx
div dword [esp + 0x4c]
cmp dword [esp + 0x24], 0
mov ecx, dword [esp + 0x28]
je 0x408da8
mov eax, 0x2d
mov word [ebx], ax
add ebx, 2
mov eax, dword [esp + 0x28]
test eax, eax
je 0x408deb
movsx ax, byte ds:[esi]
dec ecx
inc esi
mov word [ebx], ax
mov eax, edx
add ebx, 2
dec edx
test eax, eax
jne 0x408de3
test ecx, ecx
je 0x408de7
movzx eax, word [0x46dd58]
dec ecx
mov word [ebx], ax
mov edx, 1
movsx eax, byte [esi]
mov word [ebx + 2], ax
add ebx, 4
inc esi
test ecx, ecx
jne 0x408db0
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x24], 0
je 0x408df7
add dword [esp + 0x10], 2
mov esi, ebp
mov ecx, edi
sub esi, eax
push ebx
mov edx, esi
call fcn.00406f80
mov eax, dword [esp + 0x38]
lea edi, [ebx + esi*2]
mov ecx, dword [esp + 0x10]
add eax, ebp
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
lea ebp, [ecx + eax*2]
mov ecx, dword [esi*8 + 0x46dd20]
lea eax, [ecx + 2]
add eax, ebp
cmp edx, eax
jae 0x408e93
lea ebx, [ecx + 2]
lea eax, [edx + edx]
add ebx, ebp
mov edx, dword [0x46ec98]
cmp eax, ebx
cmovae ebx, eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0xa]
call fcn.00405ce0
mov edi, eax
xor ecx, ecx
lea eax, [edi + 8]
push ebp
mov dword [edi], ebx
mov dword [edi + 4], eax
mov word [eax + ebx], cx
mov ebx, dword [esp + 0x18]
push dword [ebx + 4]
push dword [edi + 4]
call fcn.00422f70
add esp, 0xc
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x408e85
nop dword [eax]
call fcn.00405dc0
mov eax, dword [edi + 4]
mov ecx, ebp
shr ecx, 1
mov dword [esp + 0x14], edi
lea edi, [eax + ecx*2]
mov eax, 0x20
mov word [edi], ax
lea eax, [edi + 2]
push dword [esi*8 + 0x46dd20]
push dword [esi*8 + 0x46dd24]
push eax
call fcn.00422f70
mov ecx, dword [esi*8 + 0x46dd20]
add ebp, 2
add esp, 0xc
lea eax, [ecx + 2]
shr eax, 1
add ebp, ecx
lea ebx, [edi + eax*2]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x30]
mov edi, ebp
sub edi, dword [esp + 0x44]
test dword [eax], 0xc0000000
je 0x409001
movzx esi, word [eax + 6]
add esi, esi
cmp edi, esi
jae 0x409001
mov edx, dword [esp + 0x1c]
sub esi, edi
lea ecx, [esi + ebp]
mov dword [esp + 0x24], ecx
cmp edx, ecx
jae 0x408f75
lea eax, [edx + edx]
mov edx, ecx
cmp eax, ecx
cmovae edx, eax
mov dword [esp + 0x1c], edx
lea ecx, [edx + 0xa]
mov edx, dword [0x46ec98]
call fcn.00405ce0
mov ecx, dword [esp + 0x1c]
mov ebx, eax
lea eax, [ebx + 8]
xor edx, edx
push ebp
mov dword [ebx + 4], eax
mov dword [ebx], ecx
mov word [eax + ecx], dx
mov eax, dword [esp + 0x18]
push dword [eax + 4]
push dword [ebx + 4]
call fcn.00422f70
mov ecx, dword [esp + 0x20]
add esp, 0xc
add ecx, 0xfffffff8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x408f65
nop
call fcn.00405dc0
mov eax, dword [ebx + 4]
shr ebp, 1
mov dword [esp + 0x14], ebx
lea ebx, [eax + ebp*2]
mov eax, dword [esp + 0x30]
mov ecx, dword [eax]
test cl, cl
jns 0x408f82
movzx eax, word ds:[eax + 8]
jmp 0x408f87
mov eax, 0x20
shr esi, 1
mov dword [esp + 0x20], eax
test ecx, ecx
jns 0x408fb1
test esi, esi
je 0x408fac
movzx edx, ax
mov ecx, esi
mov eax, edx
mov edi, ebx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea ebp, [esi + esi]
jmp 0x408ff3
mov eax, edi
lea ebp, [esi + esi]
and eax, 0xfffffffe
mov ecx, ebx
sub ecx, eax
push edi
push ecx
lfence
lea eax, [ecx + ebp]
mov dword [esp + 0x4c], ecx
push eax
call fcn.00422f70
add esp, 0xc
test esi, esi
je 0x408ff3
mov eax, dword [esp + 0x20]
mov ecx, esi
mov edi, dword [esp + 0x44]
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
add ebx, ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], ebp
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x1c]
test edi, edi
jne 0x407ac3
mov eax, dword [esp + 0x14]
xor edx, edx
pop edi
pop esi
mov ecx, dword [eax + 4]
mov dword [eax], ebp
shr ebp, 1
mov word [ecx + ebp*2], dx
mov ecx, dword [esp + 0x46c]
pop ebp
pop ebx
xor ecx, esp
call fcn.00421161
add esp, 0x468
ret 4