Function at 0x40ad30
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x9b0
mov edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp byte [edx], 0
je 0x40b100
mov eax, dword [edi + 0xd4]
mov dword [esp + 0x78], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0xb8], 0
mov dword [esp + 0x708], 0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xbc], 0
mov dword [esp + 0x70c], 0
test eax, eax
je 0x40ae13
lea ecx, [esp + 0x28]
lea edx, [esp + 0x40]
lea esi, [esp + 0x78]
push ecx
push edx
push esi
push esi
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_GetProcessTimes]
test eax, eax
jne 0x40ae13
call fcn.004150e0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40ae13
lea eax, [esp + 0x298]
push eax
call fcn.00414ed0
add esp, 4
lea eax, [esp + 0x708]
lea ecx, [esp + 0xb8]
lea edx, [esp + 0x60]
push eax
push ecx
push edx
call dword [sym.imp.kernel32.dll_GetSystemTimes]
mov dword [esp + 0x18], eax
test eax, eax
mov eax, 0
jne 0x40ae57
call fcn.004150e0
mov dword [esp + 0x294], eax
mov eax, 1
mov dword [esp + 0x20], edx
mov dword [esp + 0x298], edx
mov ecx, dword [esp + 0xbc]
mov dword [esp + 0x290], eax
mov ebx, dword [esp + 0xb8]
mov eax, dword [edi + 0x60]
mov edx, dword [edi + 0x64]
movd xmm2, dword [esp + 0x708]
cmp ebx, eax
mov esi, ecx
movd xmm0, ebx
movd xmm1, ecx
sbb esi, edx
mov esi, 0
punpckldq xmm0, xmm2
movd xmm2, dword [esp + 0x44]
cmovb eax, esi
cmovb edx, esi
sub ebx, eax
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x70c]
sbb ecx, edx
mov edx, dword [edi + 0x68]
mov dword [esp + 0x10], ecx
mov ecx, edi
mov edi, dword [edi + 0x6c]
movd xmm3, ebx
mov eax, ebx
punpckldq xmm1, xmm3
movd xmm3, dword [esp + 0x28]
punpckldq xmm0, xmm1
pshufd xmm1, xmm0, 0xee
movd esi, xmm1
movd xmm1, dword [esp + 0x2c]
cmp esi, edx
sbb eax, edi
mov eax, 0
cmovb edx, eax
cmovb edi, eax
mov eax, 0xffffffff
sub esi, edx
punpckldq xmm2, xmm1
movd xmm1, dword [esp + 0x40]
mov edx, dword [ecx + 0x5c]
sbb ebx, edi
add esi, dword [esp + 0xc]
mov edi, dword [ecx + 0x50]
punpckldq xmm1, xmm3
adc ebx, dword [esp + 0x10]
punpckldq xmm1, xmm2
cmovb esi, eax
cmovb ebx, eax
mov eax, esi
or eax, ebx
mov eax, dword [ecx + 0x58]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x54]
movdqu xmmword [ecx + 0x50], xmm1
movdqu xmmword [ecx + 0x60], xmm0
je 0x40b0d2
movd ecx, xmm1
pshufd xmm0, xmm1, 0x55
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
cmp ecx, edi
movd ecx, xmm0
pshufd xmm0, xmm1, 0xff
pshufd xmm1, xmm1, 0xee
mov edx, ecx
sbb edx, eax
mov edx, 0
cmovb edi, edx
cmovb eax, edx
sub dword [esp + 0x10], edi
movd edi, xmm0
movd xmm0, esi
mov edx, edi
sbb ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
movd ecx, xmm1
movd xmm1, ebx
mov dword [esp + 0x24], ecx
punpckldq xmm0, xmm1
cmp ecx, eax
mov ecx, dword [esp + 0xc]
sbb edx, dword [esp + 0xc]
mov edx, 0
cmovb ecx, edx
cmovb eax, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
sub ecx, eax
sbb edi, dword [esp + 0xc]
movq qword [esp + 0xa8], xmm0
shr ebx, 0x1f
fild qword [esp + 0xa8]
fnstcw word [esp + 0x3e]
movzx eax, word [esp + 0x3e]
or eax, 0x300
mov word [esp + 0x5e], ax
mov eax, 0xffffffff
fldcw word [esp + 0x5e]
fadd dword [ebx*4 + 0x5294e0]
add ecx, dword [esp + 0x10]
adc edi, dword [esp + 0x1c]
fldcw word [esp + 0x3e]
cmovb edi, eax
cmovb ecx, eax
movd xmm0, edi
movd xmm1, ecx
mov ecx, dword [ebp + 0x10]
shr edi, 0x1f
punpckldq xmm1, xmm0
movq qword [esp + 0xb0], xmm1
fild qword [esp + 0xb0]
fnstcw word [esp + 0x3c]
movzx eax, word [esp + 0x3c]
movd xmm0, ecx
or eax, 0x300
mov word [esp + 0x5c], ax
mov eax, dword [ebp + 0x14]
fldcw word [esp + 0x5c]
movd xmm1, eax
shr eax, 0x1f
fadd dword [edi*4 + 0x5294e0]
fldcw word [esp + 0x3c]
punpckldq xmm0, xmm1
mov edi, dword [ebp + 8]
movq qword [esp + 0xa0], xmm0
fild qword [esp + 0xa0]
fnstcw word [esp + 0x3a]
movzx ecx, word [esp + 0x3a]
or ecx, 0x300
mov word [esp + 0x5a], cx
fldcw word [esp + 0x5a]
fadd dword [eax*4 + 0x5294e0]
cmp dword [esp + 0x18], 0
fldcw word [esp + 0x3a]
fxch st(2)
fstp dword [esp + 0x8c]
fstp dword [esp + 0x84]
movss xmm0, dword [esp + 0x84]
divss xmm0, dword [esp + 0x8c]
fstp dword [esp + 0x88]
mulss xmm0, dword [0x528d84]
mulss xmm0, dword [esp + 0x88]
movss dword [edi + 0xd8], xmm0
je 0x40b0e6
jmp 0x40b0fd
mov edi, dword [ebp + 8]
cmp dword [esp + 0x18], 0
mov dword [edi + 0xd8], 0
jne 0x40b0fd
cmp dword [esp + 0x20], 0
je 0x40b0fd
lea eax, [esp + 0x298]
push eax
call fcn.00414ed0
add esp, 4
mov edx, dword [ebp + 0xc]
cmp byte [edx + 1], 0
je 0x40b17d
mov eax, dword [edi + 0xd4]
test eax, eax
je 0x40b17d
lea ecx, [esp + 0x290]
push ecx
push dword [eax + 8]
call dword [sym.imp.kernel32.dll_GetProcessIoCounters]
test eax, eax
je 0x40b148
movdqu xmm0, xmmword [edi + 0x90]
movdqu xmm1, xmmword [esp + 0x2a8]
movdqu xmmword [edi + 0x80], xmm0
movdqu xmmword [edi + 0x90], xmm1
jmp 0x40b17a
call fcn.004150e0
test edx, edx
mov dword [esp + 0x70c], eax
mov dword [esp + 0x710], edx
mov dword [esp + 0x708], 1
je 0x40b17a
lea eax, [esp + 0x710]
push eax
call fcn.00414ed0
add esp, 4
mov edx, dword [ebp + 0xc]
cmp byte [edx + 2], 0
je 0x40b23e
mov eax, dword [edi + 0xd4]
test eax, eax
je 0x40b23e
mov eax, dword [eax + 8]
pxor xmm0, xmm0
mov dword [esp + 0x2b4], 0
mov dword [esp + 0x2b0], 0
mov dword [esp + 0x2b8], 0
lea ecx, [esp + 0x290]
movdqa xmmword [esp + 0x2a0], xmm0
movdqa xmmword [esp + 0x290], xmm0
push 0x2c
push ecx
push eax
call dword [sym.imp.psapi.dll_GetProcessMemoryInfo]
test eax, eax
je 0x40b209
movdqu xmm0, xmmword [esp + 0x29c]
movd xmm1, dword [esp + 0x2b8]
punpckldq xmm0, xmm1
pxor xmm1, xmm1
punpckldq xmm0, xmm1
movdqu xmmword [edi + 0x40], xmm0
jmp 0x40b23b
call fcn.004150e0
test edx, edx
mov dword [esp + 0x70c], eax
mov dword [esp + 0x710], edx
mov dword [esp + 0x708], 1
je 0x40b23b
lea eax, [esp + 0x710]
push eax
call fcn.00414ed0
add esp, 4
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0xd4]
test eax, eax
je 0x40b506
movzx ecx, byte [edx + 3]
test ecx, ecx
je 0x40b506
cmp ecx, 1
je 0x40b26a
cmp dword [edi + 0xc8], 0
jne 0x40b506
mov esi, dword [eax + 8]
call fcn.00412da0
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push 8
push esi
call dword [sym.imp.advapi32.dll_OpenProcessToken]
test eax, eax
je 0x40b33c
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x290]
mov dword [esp + 0x290], eax
push ebx
call fcn.00414e10
add esp, 4
test al, al
jne 0x40b503
mov edi, dword [esp + 0x290]
lea eax, [esp + 0xb8]
mov dword [esp + 0xb8], 0
mov dword [esp + 0x60], edi
push eax
push 0
push 0
push 1
push edi
call dword [sym.imp.advapi32.dll_GetTokenInformation]
test eax, eax
je 0x40b424
mov esi, dword [esp + 0xb8]
call dword [sym.imp.kernel32.dll_GetProcessHeap]
mov dword [esp + 0x708], eax
lea eax, [esp + 0x708]
push eax
call fcn.00414e10
add esp, 4
test al, al
je 0x40b377
call fcn.004150e0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40b488
lea eax, [esp + 0x298]
jmp 0x40b47f
call fcn.004150e0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40b503
lea eax, [esp + 0x298]
push eax
call fcn.00414ed0
add esp, 4
jmp 0x40b503
push esi
push 8
push dword [esp + 0x710]
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x40b488
mov esi, eax
lea eax, [esp + 0xb8]
push eax
push dword [esp + 0xbc]
push esi
push 1
push edi
call dword [sym.imp.advapi32.dll_GetTokenInformation]
test eax, eax
je 0x40b4c7
push dword [esi]
push ebx
call fcn.0040d0d0
add esp, 8
mov ebx, dword [esp + 0x290]
test ebx, ebx
je 0x40b998
mov eax, dword [esp + 0x298]
mov edi, dword [ebp + 8]
mov edx, dword [esp + 0x294]
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0xc8]
test eax, eax
je 0x40b409
mov ecx, dword [edi + 0xcc]
test ecx, ecx
je 0x40b409
push 1
push ecx
push eax
mov dword [esp + 0x24], edx
call fcn.00403b20
mov edx, dword [esp + 0x24]
add esp, 0xc
mov eax, dword [esp + 0xc]
mov dword [edi + 0xc8], ebx
mov dword [edi + 0xcc], edx
mov dword [edi + 0xd0], eax
jmp 0x40b99b
call fcn.004150e0
mov dword [esp + 0x290], eax
mov dword [esp + 0x294], edx
push ebx
call fcn.00413fb0
add esp, 4
mov esi, eax
push 0x7a
call fcn.00415a00
add esp, 4
cmp esi, eax
mov eax, dword [esp + 0x294]
jne 0x40b474
test eax, eax
je 0x40b2e2
lea eax, [esp + 0x294]
push eax
call fcn.00414ed0
add esp, 4
jmp 0x40b2e2
test eax, eax
je 0x40b488
lea eax, [esp + 0x294]
push eax
call fcn.00414ed0
add esp, 4
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
jne 0x40b500
call fcn.004150e0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40b500
lea eax, [esp + 0x298]
push eax
call fcn.00414ed0
add esp, 4
jmp 0x40b500
call fcn.004150e0
test edx, edx
mov dword [esp + 0x290], eax
mov dword [esp + 0x294], edx
je 0x40b4ee
lea eax, [esp + 0x294]
push eax
call fcn.00414ed0
add esp, 4
mov ecx, esi
call fcn.0040a8f0
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x40b493
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx + 7]
mov bl, 1
test ecx, ecx
je 0x40b51e
cmp ecx, 1
je 0x40b571
cmp dword [edi + 0xb4], 0
je 0x40b571
movzx eax, byte [edx + 6]
test eax, eax
je 0x40b534
cmp eax, 1
je 0x40b571
cmp dword [edi + 0xc0], 0
je 0x40b571
movzx eax, byte [edx + 4]
test eax, eax
je 0x40b547
cmp eax, 1
je 0x40b571
cmp byte [edi + 0x2c], 2
je 0x40b571
movzx eax, byte [edx + 5]
test eax, eax
je 0x40b561
cmp eax, 1
je 0x40b571
cmp byte [edi + 0x3c], 2
sete bl
test bl, bl
je 0x40b567
jmp 0x40b571
xor ebx, ebx
test bl, bl
jne 0x40b571
cmp byte [ebp + 0x20], 0
je 0x40b861
mov eax, dword [edi + 0xd4]
test eax, eax
je 0x40b861
mov esi, dword [eax + 8]
mov dword [esp + 0xc], ecx
lea eax, [esp + 0x90]
push 0
push 4
push eax
push 0x1a
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x40b85e
mov ecx, dword [esp + 0x90]
test ecx, ecx
je 0x40b6be
test bl, bl
je 0x40b85e
lea eax, [esp + 0x290]
push 0
push 0x470
push eax
push ecx
push esi
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x40b7d6
lea eax, [esp + 0x708]
push 0
push 0x2a4
push eax
push dword [esp + 0x2ac]
push esi
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x40b801
movzx eax, word [esp + 0x72c]
mov ecx, dword [esp + 0x750]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x730]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
test al, al
je 0x40ba8b
mov edx, dword [esp + 0x74c]
movzx ebx, word [esp + 0x748]
movzx eax, al
cmp eax, 1
je 0x40b64c
cmp dword [edi + 0xb4], 0
jne 0x40ba8b
mov dword [esp + 0x14], ebx
mov eax, dword [section..data]
mov dword [esp + 0xc], ecx
cmp eax, 2
jne 0x40b9b1
cmp byte [0x537004], 0
lea ebx, [edi + 0xac]
je 0x40b9da
lea ecx, [esp + 0xb8]
mov edx, esi
call fcn.0040ca00
push ebx
call fcn.004076e0
add esp, 4
mov eax, dword [edi + 0xb0]
test eax, eax
je 0x40b6a9
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebx]
call fcn.00403b20
add esp, 0xc
mov eax, dword [esp + 0xc0]
movq xmm0, qword [esp + 0xb8]
jmp 0x40ba80
mov dword [esp + 0x18], ecx
lea eax, [esp + 0x60]
push 0
push 0x18
push eax
push 0
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x40b85e
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x64]
xor edx, edx
test ecx, ecx
setne dl
test bl, bl
mov dword [edi], edx
mov dword [edi + 4], ecx
je 0x40b85e
lea ecx, [esp + 0xb8]
push 0
push 0x1d8
push ecx
push eax
push esi
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x40b82c
lea edi, [esp + 0x708]
push 0
push 0x2a4
push edi
push dword [esp + 0xd4]
push esi
call dword [sym.imp.kernel32.dll_ReadProcessMemory]
test eax, eax
je 0x40b95e
lea eax, [esp + 0x290]
push 0x2a4
push edi
push eax
call fcn.00436b50
add esp, 0xc
mov eax, dword [esp + 0xc]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40bcf6
cmp eax, 1
je 0x40b773
cmp dword [edi + 0xb4], 0
jne 0x40bcf6
mov eax, dword [section..data]
cmp eax, 2
jne 0x40bc20
cmp byte [0x537004], 0
mov ebx, edi
lea edi, [edi + 0xac]
je 0x40bc47
lea ecx, [esp + 0x28]
mov edx, esi
call fcn.0040ca00
push edi
call fcn.004076e0
add esp, 4
mov eax, dword [ebx + 0xb0]
test eax, eax
je 0x40b7c7
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [edi]
call fcn.00403b20
add esp, 0xc
mov eax, dword [esp + 0x30]
movq xmm0, qword [esp + 0x28]
jmp 0x40bcec
call fcn.004150e0
test edx, edx
mov dword [esp + 0x70c], eax
mov dword [esp + 0x710], edx
mov dword [esp + 0x708], 1
je 0x40b85e
lea eax, [esp + 0x710]
jmp 0x40b855
call fcn.004150e0
test edx, edx
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], edx
mov dword [esp + 0xb8], 1
je 0x40b85e
lea eax, [esp + 0xc0]
jmp 0x40b855
call fcn.004150e0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40b85e
lea eax, [esp + 0x298]
push eax
call fcn.00414ed0
add esp, 4
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 8]
mov esi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x18]
test eax, eax
je 0x40b93b
cmp eax, 1
je 0x40b882
cmp byte [edi + 0x1c], 2
jne 0x40b93b
mov edi, dword [edi + 0xd4]
test edi, edi
je 0x40b8f9
lea eax, [esp + 0x290]
push 0x20a
push 0
push eax
call fcn.00438740
add esp, 0xc
mov edi, dword [edi + 8]
call fcn.00412da0
push 0x105
lea ecx, [esp + 0x294]
push ecx
push eax
push edi
call dword [sym.imp.psapi.dll_GetModuleFileNameExW]
lea edi, [esp + 0xb8]
lea edx, [esp + 0x290]
mov ecx, edi
push 0x105
call fcn.0040c8d0
add esp, 4
lea eax, [esp + 0x708]
push edi
push eax
call fcn.00424530
add esp, 8
mov edi, dword [ebp + 8]
cmp byte [edi + 0x1c], 2
jne 0x40b90a
jmp 0x40b91f
mov byte [esp + 0x714], 2
mov edi, dword [ebp + 8]
cmp byte [edi + 0x1c], 2
je 0x40b91f
mov eax, dword [edi + 0x14]
test eax, eax
je 0x40b91f
push 1
push eax
push dword [edi + 0x10]
call fcn.00403b20
add esp, 0xc
movq xmm0, qword [esp + 0x708]
movq xmm1, qword [esp + 0x710]
movq qword [edi + 0x18], xmm1
movq qword [edi + 0x10], xmm0
xor eax, eax
sub ebx, dword [edi + 0x70]
sbb esi, dword [edi + 0x74]
cmovb ebx, eax
cmovb esi, eax
mov dword [edi + 0x7c], esi
mov dword [edi + 0x78], ebx
mov byte [edi + 0xdc], 1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004150e0
test edx, edx
mov dword [esp + 0x294], eax
mov dword [esp + 0x298], edx
mov dword [esp + 0x290], 1
je 0x40b990
lea eax, [esp + 0x298]
push eax
call fcn.00414ed0
add esp, 4
mov edi, dword [ebp + 8]
jmp 0x40b85e
mov edi, dword [ebp + 8]
mov ecx, esi
call fcn.0040a8f0
lea eax, [esp + 0x60]
push eax
call fcn.00404d70
jmp 0x40b36f
push section..data
push section..data
mov ebx, edx
call fcn.0043ab30
mov edx, ebx
add esp, 8
cmp byte [0x537004], 0
lea ebx, [edi + 0xac]
jne 0x40b675
lea eax, [esp + 0xb8]
push dword [esp + 0x14]
push edx
push esi
push eax
call fcn.0040c7d0
add esp, 0x10
mov edi, dword [esp + 0xb8]
test edi, edi
je 0x40ba32
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x14], eax
push edi
call fcn.00404e40
add esp, 4
lea ecx, [esp + 0x60]
mov edx, eax
call fcn.0040c670
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40ba4a
add eax, eax
push 2
push eax
push edi
call fcn.00403b20
add esp, 0xc
jmp 0x40ba4a
mov dword [esp + 0x60], 4
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
push ebx
call fcn.004076e0
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xb0]
test eax, eax
je 0x40ba73
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebx]
call fcn.00403b20
add esp, 0xc
mov eax, dword [esp + 0x68]
movq xmm0, qword [esp + 0x60]
mov edi, dword [ebp + 8]
mov dword [ebx + 8], eax
movq qword [ebx], xmm0
mov ecx, dword [esp + 0xc]
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 6]
test eax, eax
je 0x40c00b
cmp eax, 1
je 0x40baac
cmp dword [edi + 0xc0], 0
jne 0x40c00b
lea eax, [edi + 0xb8]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xb8]
push 0x1c
push eax
push ecx
push esi
mov ebx, ecx
call dword [sym.imp.kernel32.dll_VirtualQueryEx]
test eax, eax
je 0x40bbb3
mov eax, dword [esp + 0xb8]
lea ecx, [esp + 0x40]
sub eax, ebx
add eax, dword [esp + 0xc4]
push eax
push ebx
push esi
push ecx
call fcn.0040c7d0
add esp, 0x10
mov eax, dword [esp + 0x40]
test eax, eax
mov dword [esp + 0x24], eax
je 0x40bbc3
push 1
push 0x5295d0
lea eax, [esp + 0xc0]
push eax
call fcn.004339a0
add esp, 0xc
movzx eax, word [esp + 0xc0]
test ax, ax
mov dword [esp + 0xc], eax
jne 0x40be77
mov eax, dword [esp + 0xb8]
cmp eax, dword [esp + 0xbc]
je 0x40bde4
movzx edx, byte [eax]
movzx ecx, dl
test dl, dl
mov dword [esp + 0xc], ecx
jns 0x40be77
mov ecx, dword [esp + 0xc]
mov ebx, edi
movzx edi, byte [eax + 1]
and ecx, 0x1f
and edi, 0x3f
cmp dl, 0xdf
jbe 0x40bc10
mov dword [esp + 0xc], ecx
movzx ecx, byte [eax + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp dl, 0xf0
jb 0x40be54
movzx eax, byte [eax + 3]
mov edx, dword [esp + 0xc]
shl ecx, 6
mov edi, ebx
and edx, 7
and eax, 0x3f
shl edx, 0x12
or eax, ecx
or edx, eax
mov eax, edx
cmp edx, 0x110000
jne 0x40be5f
jmp 0x40bde4
mov dword [esp + 0x44], 0x5294e8
mov dword [esp + 0x48], 0x29
mov ebx, dword [esp + 0x14]
push ebx
call fcn.004076e0
add esp, 4
mov eax, dword [edi + 0xbc]
test eax, eax
je 0x40bbed
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebx]
call fcn.00403b20
add esp, 0xc
mov dword [edi + 0xb8], 4
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0
jmp 0x40c008
shl ecx, 6
or ecx, edi
mov edi, ebx
mov dword [esp + 0xc], ecx
jmp 0x40be77
push section..data
push section..data
call fcn.0043ab30
add esp, 8
cmp byte [0x537004], 0
mov ebx, edi
lea edi, [edi + 0xac]
jne 0x40b796
movzx eax, word [esp + 0x2d0]
lea ecx, [esp + 0x28]
push eax
push dword [esp + 0x2d8]
push esi
push ecx
call fcn.0040c7d0
add esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x40bca1
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
push ebx
call fcn.00404e40
add esp, 4
lea ecx, [esp + 0x40]
mov edx, eax
call fcn.0040c670
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40bcb9
add eax, eax
push 2
push eax
push ebx
call fcn.00403b20
add esp, 0xc
jmp 0x40bcb9
mov dword [esp + 0x40], 4
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
push edi
call fcn.004076e0
add esp, 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xb0]
test eax, eax
je 0x40bce2
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [edi]
call fcn.00403b20
add esp, 0xc
mov eax, dword [esp + 0x48]
movq xmm0, qword [esp + 0x40]
mov dword [edi + 8], eax
movq qword [edi], xmm0
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 6]
test eax, eax
je 0x40c372
cmp eax, 1
je 0x40bd17
cmp dword [edi + 0xc0], 0
jne 0x40c372
lea ebx, [edi + 0xb8]
lea eax, [esp + 0x94]
push esi
lea ecx, [esp + 0x294]
push ecx
push eax
call fcn.00405db0
add esp, 0xc
mov eax, dword [esp + 0x94]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x40bdfa
lea eax, [esp + 0x28]
push 1
push 0x5295d0
push eax
call fcn.004339a0
add esp, 0xc
movzx eax, word [esp + 0x30]
test ax, ax
mov dword [esp + 0x10], eax
jne 0x40c1ca
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x2c]
je 0x40bde4
movzx edx, byte [eax]
movzx ecx, dl
test dl, dl
mov dword [esp + 0x10], ecx
jns 0x40c1ca
mov ecx, dword [esp + 0x10]
movzx edi, byte [eax + 1]
and ecx, 0x1f
and edi, 0x3f
cmp dl, 0xdf
jbe 0x40be43
mov dword [esp + 0x10], ecx
movzx ecx, byte [eax + 2]
shl edi, 6
and ecx, 0x3f
or ecx, edi
cmp dl, 0xf0
jb 0x40c1a6
movzx eax, byte [eax + 3]
mov edx, dword [esp + 0x10]
shl ecx, 6
mov edi, dword [ebp + 8]
and edx, 7
and eax, 0x3f
shl edx, 0x12
or eax, ecx
or edx, eax
mov eax, edx
cmp edx, 0x110000
jne 0x40c1b2
push 0x5295fc
push 0x2b
push 0x5295d1
call fcn.0043dc30
add esp, 0xc
ud2
push ebx
call fcn.004076e0
add esp, 4
mov eax, dword [edi + 0xbc]
test eax, eax
je 0x40be20
shl eax, 2
lea eax, [eax + eax*2]
push 4
push eax
push dword [ebx]
call fcn.00403b20
add esp, 0xc
mov dword [edi + 0xb8], 4
mov dword [edi + 0xbc], 0
mov dword [edi + 0xc0], 0
jmp 0x40c36f
shl ecx, 6
or ecx, edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], ecx
jmp 0x40c1ca
mov eax, dword [esp + 0xc]
mov edi, ebx
shl eax, 0xc
or eax, ecx
cmp eax, 0xffff
jbe 0x40be73
add eax, 0xff0000
shr eax, 0xa
or eax, 0xd800
mov dword [esp + 0xc], eax
mov ecx, edi
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov edi, dword [edi + 0xb8]
mov ebx, dword [ecx + 0xc0]
mov dword [ecx + 0xc0], 0
mov dword [esp + 0x50], eax
mov dword [esp + 0x20], edx
test ebx, ebx
je 0x40bec4
add edi, 4
jmp 0x40beae
add edi, 0xc
dec ebx
je 0x40bec4
mov eax, dword [edi]
test eax, eax
je 0x40bea8
push 1
push eax
push dword [edi - 4]
call fcn.00403b20
add esp, 0xc
jmp 0x40bea8
mov ecx, dword [esp + 0x20]
lea eax, [ecx + ecx]
neg eax
mov dword [esp + 0x54], eax
xor eax, eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
je 0x40bfec
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x54]
xor ebx, ebx
xor edi, edi
lea eax, [eax + edx*2]
lea edx, [ecx + edx*2]
cmp word [eax + edi*2], 0
je 0x40bf09
add ebx, 0xfffffffe
inc edi
cmp edx, ebx
jne 0x40bef5
jmp 0x40bfec
mov edx, dword [esp + 0x1c]
add edx, edi
jb 0x40c518
cmp edx, dword [esp + 0x20]
ja 0x40c52c
xor edx, edx
mov ecx, ebx
add ecx, edx
je 0x40bfec
mov ecx, dword [esp + 0xc]
cmp cx, word [eax + edx]
lea edx, [edx + 2]
jne 0x40bf21
push edi
push eax
lea ebx, [esp + 0xc0]
push ebx
call fcn.0041dd70
add esp, 0xc
push ebx
call fcn.00424550
add esp, 4
push edx
push eax
lea ebx, [esp + 0x68]
push ebx
call fcn.00424560
add esp, 0xc
push ebx
lea eax, [esp + 0x2c]
push eax
call fcn.00409950
add esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc0]
cmp eax, dword [ebx + 0xbc]
jne 0x40bf94
push eax
push dword [esp + 0x18]
call fcn.00407270
add esp, 8
mov eax, dword [ebx + 0xc0]
mov ecx, dword [ebx + 0xb8]
mov edx, dword [esp + 0x30]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 + 8], edx
movq xmm0, qword [esp + 0x28]
movq qword [ecx + eax*4], xmm0
inc dword [ebx + 0xc0]
mov eax, dword [esp + 0xbc]
test eax, eax
je 0x40bfd3
push 1
push eax
push dword [esp + 0xc0]
call fcn.00403b20
add esp, 0xc
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [edx + edi + 1]
cmp eax, ecx
jbe 0x40bed3
jmp 0x40c33e
mov eax, dword [esp + 0x50]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40c008
add eax, eax
push 2
push eax
push dword [esp + 0x2c]
call fcn.00403b20
add esp, 0xc
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx + 4]
test eax, eax
je 0x40c01c
cmp eax, 1
jne 0x40c020
mov cl, 1
jmp 0x40c027
xor ecx, ecx
jmp 0x40c027
cmp byte [edi + 0x2c], 2
sete cl
movzx ebx, byte [edx + 5]
test ebx, ebx
je 0x40c03d
cmp ebx, 1
je 0x40c049
cmp byte [edi + 0x3c], 2
sete al
jmp 0x40c03f
xor eax, eax
or al, cl
cmp al, 1
jne 0x40b861
lea eax, [edi + 0x20]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push dword [esp + 0x18]
push dword [esp + 0x14]
push esi
push eax
call fcn.0040c7d0
add esp, 0x10
mov edx, dword [esp + 0x28]
test edx, edx
je 0x40c13a
mov ecx, dword [esp + 0x2c]
lea eax, [edi + 0x30]
lea esi, [esp + 0xb8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ecx
mov ecx, esi
push dword [esp + 0x30]
call fcn.0040c8d0
add esp, 4
lea edi, [esp + 0x60]
push esi
push edi
call fcn.00424530
add esp, 8
push edi
call fcn.00424550
add esp, 4
mov esi, edx
movzx ecx, bl
mov edx, eax
push dword [esp + 0x10]
push esi
call fcn.0040c570
add esp, 8
cmp byte [esp + 0xc], 0
je 0x40c161
mov edi, dword [ebp + 8]
movsd xmm0, qword [esp + 0x60]
movsd xmm1, qword [esp + 0x68]
mov edx, dword [ebp + 0xc]
mov esi, dword [esp + 0x14]
cmp byte [edi + 0x2c], 2
movsd qword [esp + 0xc0], xmm1
movsd qword [esp + 0xb8], xmm0
je 0x40c119
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40c119
push 1
push eax
push dword [esi]
call fcn.00403b20
mov edx, dword [ebp + 0xc]
add esp, 0xc
movq xmm0, qword [esp + 0xb8]
movq xmm1, qword [esp + 0xc0]
movq qword [esi + 8], xmm1
movq qword [esi], xmm0
mov esi, dword [esp + 0x18]
jmp 0x40c185
cmp byte [edi + 0x2c], 2
je 0x40c158
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40c158
push 1
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call fcn.00403b20
add esp, 0xc
mov byte [edi + 0x2c], 2
jmp 0x40b85e
mov eax, dword [esp + 0x64]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [esp + 0x18]
test eax, eax
je 0x40c185
push 1
push eax
push dword [esp + 0x68]
call fcn.00403b20
mov edx, dword [ebp + 0xc]
add esp, 0xc
test esi, esi
je 0x40b861
add esi, esi
push 2
push esi
push dword [esp + 0x24]
call fcn.00403b20
mov edx, dword [ebp + 0xc]
add esp, 0xc
jmp 0x40b861
mov eax, dword [esp + 0x10]
mov edi, dword [ebp + 8]
shl eax, 0xc
or eax, ecx
cmp eax, 0xffff
jbe 0x40c1c6
add eax, 0xff0000
shr eax, 0xa
or eax, 0xd800
mov dword [esp + 0x10], eax
mov ecx, edi
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
mov edi, dword [edi + 0xb8]
mov ebx, dword [ecx + 0xc0]
mov dword [ecx + 0xc0], 0
mov dword [esp + 0x54], eax
mov dword [esp + 0x24], edx
test ebx, ebx
je 0x40c221
add edi, 4
jmp 0x40c20b
add edi, 0xc
dec ebx
je 0x40c221
mov eax, dword [edi]
test eax, eax
je 0x40c205
push 1
push eax
push dword [edi - 4]
call fcn.00403b20
add esp, 0xc
jmp 0x40c205
mov ecx, dword [esp + 0x24]
lea eax, [ecx + ecx]
neg eax
mov dword [esp + 0x20], eax
xor eax, eax
cmp eax, ecx
mov dword [esp + 0x14], eax
je 0x40c353
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
xor ebx, ebx
xor edi, edi
lea eax, [eax + edx*2]
lea edx, [ecx + edx*2]
cmp word [eax + edi*2], 0
je 0x40c266
add ebx, 0xfffffffe
inc edi
cmp edx, ebx
jne 0x40c252
jmp 0x40c353
mov edx, dword [esp + 0x14]
add edx, edi
jb 0x40c540
cmp edx, dword [esp + 0x24]
ja 0x40c554
xor edx, edx
mov ecx, ebx
add ecx, edx
je 0x40c353
mov ecx, dword [esp + 0x10]
cmp cx, word [eax + edx]
lea edx, [edx + 2]
jne 0x40c27e
push edi
push eax
lea ebx, [esp + 0x30]
push ebx
call fcn.0041dd70
add esp, 0xc
push ebx
call fcn.00424550
add esp, 4
push edx
push eax
lea ebx, [esp + 0x48]
push ebx
call fcn.00424560
add esp, 0xc
push ebx
lea eax, [esp + 0x7c]
push eax
call fcn.00409950
add esp, 8
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc0]
cmp eax, dword [ebx + 0xbc]
jne 0x40c2ee
push eax
push dword [esp + 0x54]
call fcn.00407270
add esp, 8
mov eax, dword [ebx + 0xc0]
mov ecx, dword [ebx + 0xb8]
mov edx, dword [esp + 0x80]
lea eax, [eax + eax*2]
mov dword [ecx + eax*4 + 8], edx
movq xmm0, qword [esp + 0x78]
movq qword [ecx + eax*4], xmm0
inc dword [ebx + 0xc0]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x40c32a
push 1
push eax
push dword [esp + 0x30]
call fcn.00403b20
add esp, 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
lea eax, [edx + edi + 1]
cmp eax, ecx
jbe 0x40c230
lea eax, [edx + edi + 1]
push 0x52960c
push ecx
push eax
call fcn.0043df50
add esp, 0xc
ud2
mov eax, dword [esp + 0x54]
mov edi, dword [ebp + 8]
test eax, eax
je 0x40c36f
add eax, eax
push 2
push eax
push dword [esp + 0x24]
call fcn.00403b20
add esp, 0xc
mov ecx, dword [ebp + 0xc]
movzx eax, byte [ecx + 4]
test eax, eax
je 0x40c383
cmp eax, 1
jne 0x40c387
mov dl, 1
jmp 0x40c38e
xor edx, edx
jmp 0x40c38e
cmp byte [edi + 0x2c], 2
sete dl
movzx ebx, byte [ecx + 5]
test ebx, ebx
je 0x40c3a8
mov ecx, dword [esp + 0x18]
cmp ebx, 1
je 0x40c3b8
cmp byte [edi + 0x3c], 2
sete al
jmp 0x40c3ae
mov ecx, dword [esp + 0x18]
xor eax, eax
or al, dl
cmp al, 1
jne 0x40b5ba
mov dword [esp + 0x10], edx
movzx edx, word [esp + 0x2b4]
lea eax, [edi + 0x20]
lea ecx, [esp + 0x78]
mov dword [esp + 0x14], eax
push edx
push dword [esp + 0x2bc]
push esi
push ecx
call fcn.0040c7d0
add esp, 0x10
mov edx, dword [esp + 0x78]
test edx, edx
je 0x40c4a5
mov ecx, dword [esp + 0x7c]
lea eax, [edi + 0x30]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x28]
push dword [esp + 0x80]
call fcn.0040c8d0
add esp, 4
lea eax, [esp + 0x28]
lea edi, [esp + 0x40]
push eax
push edi
call fcn.00424530
add esp, 8
push edi
call fcn.00424550
add esp, 4
mov edi, edx
movzx ecx, bl
mov edx, eax
push dword [esp + 0x24]
push edi
call fcn.0040c570
add esp, 8
cmp byte [esp + 0x10], 0
je 0x40c4d0
mov edi, dword [ebp + 8]
movsd xmm0, qword [esp + 0x40]
movsd xmm1, qword [esp + 0x48]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
cmp byte [edi + 0x2c], 2
movsd qword [esp + 0x30], xmm1
movsd qword [esp + 0x28], xmm0
je 0x40c48e
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40c48e
push 1
push eax
push dword [ebx]
call fcn.00403b20
mov ecx, dword [esp + 0x24]
add esp, 0xc
movq xmm0, qword [esp + 0x28]
movq xmm1, qword [esp + 0x30]
movq qword [ebx + 8], xmm1
movq qword [ebx], xmm0
jmp 0x40c4f2
cmp byte [edi + 0x2c], 2
je 0x40c4c3
mov eax, dword [edi + 0x24]
test eax, eax
je 0x40c4c3
push 1
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call fcn.00403b20
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov byte [edi + 0x2c], 2
jmp 0x40b5ba
mov eax, dword [esp + 0x44]
mov edi, dword [ebp + 8]
mov ecx, dword [esp + 0x18]
test eax, eax
je 0x40c4f2
push 1
push eax
push dword [esp + 0x48]
call fcn.00403b20
mov ecx, dword [esp + 0x24]
add esp, 0xc
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40b5ba
add eax, eax
push 2
push eax
push dword [esp + 0x28]
call fcn.00403b20
mov ecx, dword [esp + 0x24]
add esp, 0xc
jmp 0x40b5ba
push 0x52961c
push edx
push dword [esp + 0x24]
call fcn.0043e030
add esp, 0xc
ud2
push 0x52961c
push dword [esp + 0x24]
push edx
call fcn.0043dfc0
add esp, 0xc
ud2
push 0x52961c
push edx
push dword [esp + 0x1c]
call fcn.0043e030
add esp, 0xc
ud2
push 0x52961c
push dword [esp + 0x28]
push edx
call fcn.0043dfc0
add esp, 0xc
ud2