Function at 0x405aa2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4156b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push 0x1b
push 0x4173f8
lea ecx, [esp + 8]
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
call fcn.00405552
lea eax, [esp]
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x50], 0
call fcn.004056b2
push 0x418de8
lea ecx, [esp + 0x20]
push ecx
mov dword [esp + 0x24], 0x417ad8
call fcn.0040dae8
int3
push 0xffffffffffffffff
push 0x4156ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc
mov eax, dword [0x41c170]
xor eax, esp
push esi
mov esi, dword [esp + 0xd0]
push edi
mov edi, dword [esp + 0xd8]
push esi
mov dword [esp + 0xc4], eax
mov dword [esp + 0xbc], edi
call fcn.00406da2
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
jne 0x405b0d
push esi
push 0x4175f8
push 0x41c1c0
call fcn.0040d4c9
add esp, 0xc
xor al, al
jmp 0x406a56
push 0x4175d0
call fcn.0040dc3d
push 0x4175c4
push 0x4175b0
call fcn.0040dc3d
push 0x417588
call fcn.0040dc3d
push edi
push esi
push 0x417570
call fcn.0040dc3d
push esi
push 0x417560
call fcn.0040dc3d
mov eax, dword [0x41a708]
add esp, 0x24
sub eax, 0
je 0x405b68
dec eax
je 0x405b61
dec eax
jne 0x405b75
push 0x417520
jmp 0x405b6d
push 0x4174d8
jmp 0x405b6d
push 0x4174a0
call fcn.0040dc3d
add esp, 4
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov eax, ecx
mov dword [esp + 0x24], ecx
push ebx
mov dword [esp + 0x2c], ecx
xor ebx, ebx
push ebp
mov dword [esp + 0x34], ecx
xor ebp, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov edx, dword [esp + 0x1c]
mov esi, dword [edx + 0x230]
cmp esi, ebx
mov dword [esp + 0xd4], ebx
je 0x405cd0
push 0xc4
call fcn.0040c422
fld dword [0x417394]
mov edx, eax
xor eax, eax
mov ecx, 0x31
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [esi + 0x48]
mov edi, dword [eax]
lea ecx, [edx + 0x10]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [ecx + 4], edi
mov edi, dword [eax + 8]
mov dword [ecx + 8], edi
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [esi + 0x58]
mov edi, dword [ecx]
mov eax, edx
mov dword [eax], edi
mov edi, dword [ecx + 4]
mov dword [eax + 4], edi
mov edi, dword [ecx + 8]
mov dword [eax + 8], edi
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0xc], ecx
lea eax, [esi + 0x68]
mov edi, dword [eax]
lea ecx, [edx + 0x20]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [ecx + 4], edi
mov edi, dword [eax + 8]
mov dword [ecx + 8], edi
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [esi + 0x7c]
mov dword [edx + 0x40], ecx
lea eax, [esi + 0xbc]
fsub dword [esi + 0x88]
mov ecx, edx
add esp, 4
sub ecx, eax
fstp dword [edx + 0xc]
mov dword [esp + 0x10], edx
lea edi, [ecx + 0x44]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x405c57
lea eax, [esi + 8]
mov ecx, edx
sub ecx, eax
lea edi, [ecx + 0x84]
lea esp, [esp]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x405c72
test ebp, ebp
je 0x405c9f
mov ecx, dword [esp + 0x48]
mov eax, ebx
sub eax, ebp
sub ecx, ebp
sar eax, 2
sar ecx, 2
cmp eax, ecx
jae 0x405c9f
mov dword [ebx], edx
add ebx, 4
mov dword [esp + 0x44], ebx
jmp 0x405cb8
lea edx, [esp + 0x10]
push edx
push 1
push ebx
lea ecx, [esp + 0x48]
call fcn.004058c2
mov ebx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x18]
mov esi, dword [esi + 4]
inc ecx
test esi, esi
mov dword [esp + 0x18], ecx
jne 0x405bc4
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x230]
test edx, edx
jne 0x405da9
push 0xc4
call fcn.0040c422
mov edx, eax
xor eax, eax
mov ecx, 0x31
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, 0x3f800000
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x34], eax
mov dword [edx + 0x38], eax
mov dword [edx + 0x3c], eax
mov dword [edx + 0x20], eax
mov dword [edx + 0x24], eax
mov dword [edx + 0x28], eax
mov dword [edx + 0x2c], eax
mov dword [edx + 0x40], eax
mov ecx, dword [fcn.004160dc]
lea eax, [edx + 0x84]
mov dword [eax], ecx
mov ecx, dword [0x417490]
mov dword [eax + 4], ecx
mov ecx, dword [0x417494]
mov dword [eax + 8], ecx
mov ecx, dword [0x417498]
mov dword [eax + 0xc], ecx
mov cl, byte [0x41749c]
add esp, 4
test ebp, ebp
mov dword [esp + 0x10], edx
mov byte [eax + 0x10], cl
je 0x405d8c
mov ecx, dword [esp + 0x48]
mov eax, ebx
sub eax, ebp
sub ecx, ebp
sar eax, 2
sar ecx, 2
cmp eax, ecx
jae 0x405d8c
mov dword [ebx], edx
add ebx, 4
mov dword [esp + 0x44], ebx
jmp 0x405da1
lea edx, [esp + 0x10]
push edx
push 1
push ebx
lea ecx, [esp + 0x48]
call fcn.004058c2
mov ebp, dword [esp + 0x40]
inc dword [esp + 0x18]
mov eax, dword [esp + 0x28]
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
mov ecx, dword [0x41a708]
cmp ecx, edi
mov byte [esp + 0xd4], 2
mov dword [esp + 0x7c], edi
jne 0x405f07
mov ecx, dword [esp + 0x1c]
mov esi, dword [ecx + 0x234]
cmp esi, edi
je 0x406072
jmp 0x405e02
mov edi, dword [esp + 0x58]
mov ebx, dword [esp + 0x5c]
lea esp, [esp]
push 0x10
call fcn.0040c422
mov edx, dword [esi + 0xa4]
mov dword [eax + 8], edx
mov ecx, dword [esp + 0x24]
mov dword [eax + 0xc], ecx
mov edx, dword [esi + 0x8c]
mov dword [eax], edx
mov ecx, dword [esp + 0x2c]
add esp, 4
test edi, edi
mov dword [esp + 0x10], eax
mov dword [eax + 4], ecx
je 0x405e52
mov edx, dword [esp + 0x60]
mov ecx, ebx
sub ecx, edi
sub edx, edi
sar ecx, 2
sar edx, 2
cmp ecx, edx
jae 0x405e52
mov dword [ebx], eax
add ebx, 4
mov dword [esp + 0x5c], ebx
jmp 0x405e63
lea edx, [esp + 0x10]
push edx
push 1
push ebx
lea ecx, [esp + 0x60]
call fcn.004058c2
push 0x1a0
call fcn.0040c422
mov ebx, eax
xor eax, eax
mov ecx, 0x68
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [esi + 8]
mov edx, ebx
add esp, 4
mov dword [esp + 0x10], ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x405e88
mov edx, dword [esp + 0x68]
test edx, edx
mov edi, dword [esp + 0x6c]
je 0x405ebd
mov ecx, dword [esp + 0x70]
mov eax, edi
sub eax, edx
sub ecx, edx
sar eax, 2
sar ecx, 2
cmp eax, ecx
jae 0x405ebd
mov dword [edi], ebx
add edi, 4
mov dword [esp + 0x6c], edi
jmp 0x405ece
lea eax, [esp + 0x10]
push eax
push 1
push edi
lea ecx, [esp + 0x70]
call fcn.004058c2
mov ebx, dword [esi + 0x8c]
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x7c]
add eax, ebx
mov dword [esp + 0x28], eax
mov ecx, dword [esi + 0xa4]
add edi, ecx
mov dword [esp + 0x20], edi
mov esi, dword [esi + 4]
inc edx
test esi, esi
mov dword [esp + 0x7c], edx
jne 0x405df3
jmp 0x406072
cmp ecx, 1
jne 0x406072
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx + 0x234]
cmp ecx, edi
je 0x405f3d
mov edx, dword [esp + 0x20]
add eax, dword [ecx + 0x8c]
mov dword [esp + 0x28], eax
add edx, dword [ecx + 0xa4]
mov dword [esp + 0x20], edx
mov ecx, dword [ecx + 4]
cmp ecx, edi
jne 0x405f22
mov ecx, dword [esp + 0x18]
xor ebx, ebx
test ecx, ecx
jle 0x40606a
lea esp, [esp]
push 0x10
call fcn.0040c422
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x60]
add esp, 4
test edi, edi
mov dword [esp + 0x10], eax
je 0x405f8b
mov edx, dword [esp + 0x60]
mov ecx, esi
sub ecx, edi
sub edx, edi
sar ecx, 2
sar edx, 2
cmp ecx, edx
jae 0x405f8b
mov dword [esi], eax
add esi, 4
mov dword [esp + 0x5c], esi
jmp 0x405f9c
lea eax, [esp + 0x10]
push eax
push 1
push esi
lea ecx, [esp + 0x60]
call fcn.004058c2
push 0x1a0
call fcn.0040c422
mov edi, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
add esp, 4
test edi, edi
mov esi, eax
mov dword [esp + 0x10], esi
je 0x405fda
mov ecx, dword [esp + 0x70]
mov eax, edx
sub eax, edi
sub ecx, edi
sar eax, 2
sar ecx, 2
cmp eax, ecx
jae 0x405fda
mov dword [edx], esi
add edx, 4
mov dword [esp + 0x6c], edx
jmp 0x405feb
lea ecx, [esp + 0x10]
push ecx
push 1
push edx
lea ecx, [esp + 0x70]
call fcn.004058c2
xor eax, eax
test ebp, ebp
mov ecx, 0x68
mov edi, esi
rep stosd dword es:[edi], eax
je 0x406133
mov edi, dword [esp + 0x44]
sub edi, ebp
sar edi, 2
cmp edi, ebx
jbe 0x406133
mov eax, dword [ebp + ebx*4]
add eax, 0x84
mov edx, esi
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x40601a
cmp edi, ebx
jbe 0x40613c
mov eax, dword [ebp + ebx*4]
add eax, 0x44
lea edx, [esi + 0x40]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x406036
cmp edi, ebx
jbe 0x406145
mov eax, dword [esp + 0x18]
lea edi, [esi + 0x15c]
mov esi, dword [ebp + ebx*4]
inc ebx
cmp ebx, eax
mov ecx, 0x11
rep movsd dword es:[edi], dword [esi]
jl 0x405f52
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x7c], edx
shl eax, 5
push eax
call fcn.0040c446
mov ebp, eax
mov eax, dword [esp + 0x24]
lea eax, [eax + eax*2]
shl eax, 2
push eax
mov dword [esp + 0x88], ebp
call fcn.0040c446
mov ecx, dword [esp + 0x28]
lea edx, [ecx*4]
mov ebx, eax
push edx
mov dword [esp + 0x84], ebx
call fcn.0040c446
mov ecx, dword [esp + 0x2c]
mov esi, eax
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x5c], ebx
mov ebx, dword [ecx + 0x234]
add esp, 0xc
cmp ebx, eax
mov edx, ebp
mov dword [esp + 0x8c], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x84], esi
mov dword [esp + 0x74], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x4c], eax
je 0x406412
mov eax, dword [ebx + 0x8c]
xor ecx, ecx
test eax, eax
jbe 0x406194
xor esi, esi
jmp 0x406112
mov eax, dword [ebx + 0x90]
mov edi, dword [0x41ce60]
add eax, esi
test edi, edi
mov edi, dword [eax]
mov dword [edx], edi
je 0x40614e
mov edi, dword [eax + 8]
mov dword [edx + 4], edi
mov eax, dword [eax + 4]
jmp 0x406157
lea ecx, [esp + 0x3c]
jmp 0x405732
lea ecx, [esp + 0x3c]
jmp 0x405732
lea ecx, [esp + 0x3c]
jmp 0x405732
mov edi, dword [eax + 4]
mov dword [edx + 4], edi
mov eax, dword [eax + 8]
mov dword [edx + 8], eax
mov eax, dword [ebx + 0x9c]
test eax, eax
je 0x40617f
mov eax, dword [ebx + 0xa0]
fld dword [0x417394]
mov edi, dword [eax + ecx*8]
lea eax, [eax + ecx*8]
mov dword [edx + 0x18], edi
fsub dword [eax + 4]
fstp dword [edx + 0x1c]
mov eax, dword [ebx + 0x8c]
add edx, 0x20
inc ecx
add esi, 0xc
cmp ecx, eax
jb 0x406112
mov dword [esp + 0x10], edx
mov eax, dword [0x41a708]
test eax, eax
jne 0x406283
mov edi, dword [ebx + 0xa8]
test edi, edi
je 0x406283
mov eax, dword [esp + 0x18]
xor ebp, ebp
test eax, eax
jle 0x406283
mov esi, dword [esp + 0x40]
nop
test esi, esi
je 0x4063dc
mov eax, dword [esp + 0x44]
sub eax, esi
sar eax, 2
cmp eax, ebp
jbe 0x4063dc
mov ecx, dword [esi + ebp*4]
add ecx, 0x84
push ecx
lea edx, [edi + 4]
push edx
call fcn.00418766
add esp, 8
test eax, eax
je 0x406203
mov eax, dword [esp + 0x18]
inc ebp
cmp ebp, eax
jl 0x4061c2
jmp 0x406283
mov eax, dword [esp + 0x44]
sub eax, esi
sar eax, 2
cmp eax, ebp
jbe 0x4063e5
mov ecx, dword [esp + 0x68]
test ecx, ecx
je 0x4063ee
mov edx, dword [esp + 0x6c]
sub edx, ecx
mov ecx, dword [esp + 0x4c]
sar edx, 2
cmp edx, ecx
jbe 0x4063ee
mov esi, dword [esp + 0x68]
mov edi, dword [esi + ecx*4]
mov esi, dword [esp + 0x40]
mov esi, dword [esi + ebp*4]
add edi, 0x15c
cmp eax, ebp
mov ecx, 0x11
rep movsd dword es:[edi], dword [esi]
jbe 0x4063f7
mov eax, dword [esp + 0x40]
mov ebp, dword [eax + ebp*4]
mov eax, dword [esp + 0x4c]
add ebp, 0x44
cmp edx, eax
jbe 0x406400
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx + eax*4]
add eax, 0x40
mov cl, byte [ebp]
inc ebp
mov byte [eax], cl
inc eax
test cl, cl
jne 0x406278
mov eax, dword [ebx + 0xa4]
xor ebp, ebp
cmp eax, ebp
jbe 0x406399
mov dword [esp + 0x1c], ebp
jmp 0x4062a2
mov ecx, dword [esp + 0x1c]
mov edi, dword [ebx + 0xa8]
mov eax, dword [0x41ce60]
add edi, ecx
mov ecx, dword [esp + 0x88]
test eax, eax
mov eax, dword [esp + 0x50]
je 0x4062d9
movzx edx, word [edi + 0x48]
add edx, ecx
mov dword [eax], edx
movzx edx, word [edi + 0x46]
add edx, ecx
mov dword [eax + 4], edx
movzx edx, word [edi + 0x44]
jmp 0x4062ee
movzx edx, word [edi + 0x44]
add edx, ecx
mov dword [eax], edx
movzx edx, word [edi + 0x46]
add edx, ecx
mov dword [eax + 4], edx
movzx edx, word [edi + 0x48]
add edx, ecx
mov dword [eax + 8], edx
add eax, 0xc
mov dword [esp + 0x50], eax
cmp dword [0x41a708], 1
jne 0x406361
mov eax, dword [esp + 0x18]
xor esi, esi
test eax, eax
jle 0x40636e
jmp 0x406312
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x406409
mov eax, dword [esp + 0x44]
sub eax, ecx
sar eax, 2
cmp eax, esi
jbe 0x406409
mov eax, ecx
mov ecx, dword [eax + esi*4]
add ecx, 0x84
push ecx
lea edx, [edi + 4]
push edx
call fcn.00418766
add esp, 8
test eax, eax
je 0x406356
mov eax, dword [esp + 0x18]
inc esi
cmp esi, eax
jl 0x406312
jmp 0x40636e
mov eax, dword [esp + 0x84]
mov dword [eax], esi
jmp 0x40636e
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x84]
mov dword [edx], ecx
mov esi, dword [esp + 0x84]
mov ecx, dword [esp + 0x1c]
mov eax, dword [ebx + 0xa4]
add esi, 4
inc ebp
add ecx, 0x5c
cmp ebp, eax
mov dword [esp + 0x84], esi
mov dword [esp + 0x1c], ecx
jb 0x4062a2
mov eax, dword [ebx + 0xa4]
mov ecx, dword [esp + 0x74]
lea edx, [eax + ecx]
mov ecx, dword [ebx + 0x8c]
mov ebx, dword [ebx + 4]
lea eax, [edx + eax*2]
mov edx, dword [esp + 0x88]
add edx, ecx
mov ecx, dword [esp + 0x4c]
inc ecx
test ebx, ebx
mov dword [esp + 0x74], eax
mov dword [esp + 0x88], edx
mov dword [esp + 0x4c], ecx
je 0x406412
mov edx, dword [esp + 0x10]
jmp 0x4060f6
lea ecx, [esp + 0x3c]
jmp 0x405732
lea ecx, [esp + 0x3c]
jmp 0x405732
lea ecx, [esp + 0x64]
jmp 0x405732
lea ecx, [esp + 0x3c]
jmp 0x405732
lea ecx, [esp + 0x64]
jmp 0x405732
lea ecx, [esp + 0x3c]
jmp 0x405732
cmp dword [0x41a708], 1
jne 0x4064d3
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x98]
lea edx, [esp + 0x80]
push edx
mov edx, dword [esp + 0x90]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x8c]
push ecx
xor esi, esi
push edx
push eax
mov dword [esp + 0x94], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x70], esi
call fcn.00404192
mov edi, dword [esp + 0x9c]
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x94]
mov ebp, dword [esp + 0x70]
add esp, 0x20
test edi, edi
mov dword [esp + 0x78], ebx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x8c], ebp
jle 0x4064d7
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x4064ca
mov eax, dword [esp + 0x5c]
sub eax, ecx
sar eax, 2
cmp eax, esi
jbe 0x4064ca
mov edx, dword [esp + 0x20]
push edx
mov eax, ecx
mov ecx, dword [eax + esi*4]
push esi
push ecx
push ebp
push ebx
call fcn.004043a2
add esp, 0x14
inc esi
cmp esi, edi
jge 0x4064d7
jmp 0x406498
lea ecx, [esp + 0x54]
jmp 0x405732
mov edi, dword [esp + 0x7c]
xor ebx, ebx
mov ebp, dword [esp + 0x58]
mov word [esp + 0x10], bx
mov word [esp + 0x12], bx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x14], 2
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x15], bl
mov eax, dword [esp + 0x14]
mov word [esp + 0x10], bx
mov word [esp + 0x12], 0xc
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x14], 2
mov byte [esp + 0x16], 3
mov byte [esp + 0x17], bl
mov byte [esp + 0x15], bl
mov dword [esp + 0xa0], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0xa4], eax
mov word [esp + 0x10], bx
mov word [esp + 0x12], 0x18
mov eax, dword [esp + 0x10]
mov byte [esp + 0x14], 1
mov byte [esp + 0x16], 5
mov byte [esp + 0x17], bl
mov byte [esp + 0x15], bl
mov dword [esp + 0xa8], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xb0], eax
mov byte [esp + 0x14], 0x11
mov byte [esp + 0x16], bl
mov byte [esp + 0x17], bl
mov byte [esp + 0x15], bl
mov eax, dword [esp + 0x14]
mov dword [esp + 0xb4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0xbc], eax
mov dword [esp + 0xac], edx
mov word [esp + 0x10], 0xff
mov word [esp + 0x12], bx
mov edx, dword [esp + 0x10]
mov eax, 0xfde8
cmp ecx, eax
mov dword [esp + 0xb8], edx
mov byte [esp + 0x31], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x32], bl
jg 0x4065cc
cmp dword [esp + 0x20], eax
mov byte [esp + 0x30], bl
jle 0x4065d1
mov byte [esp + 0x30], 1
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0xc0]
push 0x417390
push edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], 0x20
call fcn.0040d5df
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x406632
mov eax, dword [esp + 0x68]
cmp eax, ebx
je 0x40660d
push eax
call fcn.0040c8af
add esp, 4
cmp ebp, ebx
je 0x40661a
push ebp
call fcn.0040c8af
add esp, 4
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x40662b
push eax
call fcn.0040c8af
add esp, 4
xor al, al
jmp 0x406a54
mov al, byte [esp + 0x30]
xor ebx, ebx
test al, al
mov dword [esp + 0x10], ebx
jne 0x40669b
mov eax, dword [esp + 0x20]
lea ecx, [eax + eax*2]
shl ecx, 1
push ecx
call fcn.0040c446
mov ebx, eax
mov eax, dword [esp + 0x24]
add esp, 4
xor edx, edx
test eax, eax
mov dword [esp + 0x10], ebx
jle 0x40669b
mov eax, dword [esp + 0x78]
lea ecx, [ebx + 4]
add eax, 8
lea ebx, [ebx]
mov bp, word [eax - 8]
mov word [ecx - 4], bp
mov bp, word [eax - 4]
mov word [ecx - 2], bp
mov bp, word [eax]
mov word [ecx], bp
mov ebp, dword [esp + 0x20]
inc edx
add eax, 0xc
add ecx, 6
cmp edx, ebp
jl 0x406672
mov ebp, dword [esp + 0x58]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
push 0x417460
call fcn.0040dc3d
push edi
push 0x417450
call fcn.0040dc3d
push esi
push 0x10
lea edx, [esp + 0xb0]
push 1
push edx
call fcn.0040cbb5
push 4
lea eax, [esp + 0xec]
push 0x417368
push eax
mov dword [esp + 0xf8], 0x20
call fcn.0040ccc2
push esi
push 1
lea ecx, [esp + 0xfc]
push 8
push ecx
call fcn.0040cbb5
add esp, 0x44
push esi
push 8
lea edx, [esp + 0xa8]
push 4
push edx
call fcn.0040cbb5
push 4
lea eax, [esp + 0xd4]
push 0x417370
push eax
mov dword [esp + 0xe0], 0x1c
call fcn.0040ccc2
push esi
push 1
lea ecx, [esp + 0xe4]
push 8
push ecx
call fcn.0040cbb5
push esi
push 0x1c
lea edx, [esp + 0x54]
push 1
push edx
call fcn.0040cbb5
mov eax, dword [esp + 0x64]
push 4
lea ecx, [esp + 0x100]
shl eax, 5
push 0x417360
push ecx
mov dword [esp + 0x10c], eax
call fcn.0040ccc2
add esp, 0x48
push esi
push 1
lea edx, [esp + 0xc8]
push 8
push edx
call fcn.0040cbb5
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x90]
push esi
push 0x20
push eax
push ecx
call fcn.0040cbb5
mov al, byte [esp + 0x50]
add esp, 0x20
test al, al
mov eax, dword [esp + 0x20]
push 4
jne 0x4067f2
lea edx, [eax + eax*2]
lea eax, [esp + 0xc4]
shl edx, 1
push 0x417350
push eax
mov dword [esp + 0xd0], edx
call fcn.0040ccc2
push esi
push 1
lea ecx, [esp + 0xd4]
push 8
push ecx
call fcn.0040cbb5
mov eax, dword [esp + 0x3c]
push esi
push 2
lea edx, [eax + eax*2]
push edx
push ebx
jmp 0x406836
lea eax, [eax + eax*2]
lea ecx, [esp + 0xc4]
shl eax, 2
push 0x417358
push ecx
mov dword [esp + 0xd0], eax
call fcn.0040ccc2
push esi
push 1
lea edx, [esp + 0xd4]
push 8
push edx
call fcn.0040cbb5
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x94]
push esi
push 4
lea eax, [eax + eax*2]
push eax
push ecx
call fcn.0040cbb5
mov edx, dword [esp + 0x4c]
add esp, 0x2c
push 4
lea ecx, [esp + 0xc4]
lea eax, [edx*4]
push 0x417448
push ecx
mov dword [esp + 0xd0], eax
call fcn.0040ccc2
push esi
push 1
lea edx, [esp + 0xd4]
push 8
push edx
call fcn.0040cbb5
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0xa8]
push esi
push 4
push eax
push ecx
call fcn.0040cbb5
mov edx, dword [esp + 0x50]
push 4
lea eax, [esp + 0xf0]
shl edx, 4
push 0x417348
push eax
mov dword [esp + 0xfc], edx
call fcn.0040ccc2
push esi
push 1
lea ecx, [esp + 0x100]
push 8
push ecx
call fcn.0040cbb5
add esp, 0x48
xor edi, edi
test ebp, ebp
je 0x4068ea
mov eax, dword [esp + 0x5c]
sub eax, ebp
sar eax, 2
cmp eax, edi
jbe 0x4068ea
mov edx, dword [ebp + edi*4]
push esi
push 0x10
push 1
push edx
call fcn.0040cbb5
add esp, 0x10
inc edi
jmp 0x4068c4
mov eax, dword [esp + 0x24]
imul eax, eax, 0x1a0
push 4
lea ecx, [esp + 0xc4]
push 0x417440
push ecx
mov dword [esp + 0xd0], eax
call fcn.0040ccc2
push esi
push 1
lea edx, [esp + 0xd4]
push 8
push edx
call fcn.0040cbb5
mov ebx, dword [esp + 0x84]
mov ebp, dword [esp + 0x88]
add esp, 0x1c
xor edi, edi
test ebx, ebx
je 0x40695a
mov eax, ebp
sub eax, ebx
sar eax, 2
cmp eax, edi
jbe 0x40695a
mov eax, dword [ebx + edi*4]
push esi
push 0x1a0
push 1
push eax
call fcn.0040cbb5
add esp, 0x10
inc edi
jmp 0x406934
push 4
lea ecx, [esp + 0xc4]
push 0x417340
push ecx
mov dword [esp + 0xd0], 0
call fcn.0040ccc2
push esi
push 1
lea edx, [esp + 0xd4]
push 8
push edx
call fcn.0040cbb5
push esi
call fcn.0040d2e2
push 0
push 0
push esi
mov edi, eax
call fcn.0040d43b
push esi
push 0x10
lea eax, [esp + 0xc4]
push 1
push eax
mov dword [esp + 0xd0], edi
mov dword [esp + 0xd8], 0x10
mov dword [esp + 0xcc], 0x18644421
mov dword [esp + 0xd4], 8
call fcn.0040cbb5
push esi
call fcn.0040d1a3
mov eax, dword [esp + 0x50]
add esp, 0x40
test eax, eax
je 0x4069f1
push eax
call fcn.0040ce7d
add esp, 4
mov eax, dword [esp + 0x78]
test eax, eax
je 0x406a02
push eax
call fcn.0040ce7d
add esp, 4
mov eax, dword [esp + 0x80]
test eax, eax
je 0x406a16
push eax
call fcn.0040ce7d
add esp, 4
mov eax, dword [esp + 0x58]
test eax, eax
je 0x406a27
push eax
call fcn.0040c8af
add esp, 4
test ebx, ebx
je 0x406a34
push ebx
call fcn.0040c8af
add esp, 4
push 0x417428
call fcn.0040dc3d
mov eax, dword [esp + 0x44]
add esp, 4
test eax, eax
je 0x406a52
push eax
call fcn.0040c8af
add esp, 4
mov al, 1
pop ebp
pop ebx
mov ecx, dword [esp + 0xc4]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xbc]
pop esi
xor ecx, esp
call fcn.0040ce17
add esp, 0xc8
ret