Function at 0x4c9808
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffb3c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c4], ecx
mov dword [ebp - 0x14c0], ecx
mov dword [ebp - 0x14bc], ecx
mov dword [ebp - 0x14b8], ecx
mov dword [ebp - 0x14b4], ecx
mov dword [ebp - 0x14b0], ecx
mov dword [ebp - 0x14ac], ecx
mov dword [ebp - 0x14a8], ecx
mov dword [ebp - 0x14a4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404aac
xor eax, eax
push ebp
push 0x4ca5c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x41b3ac]
call fcn.00420268
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4c98d3
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x12]
mov ecx, 2
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp word [ebp - 0x12], 0xaa55
jb 0x4c98b1
cmp word [ebp - 0x12], 0xaa5d
jbe 0x4c98c9
push 0x30
mov ecx, 0x4ca5d4
mov edx, 0x4ca5dc
mov eax, dword [0x50f380]
mov eax, dword [eax]
call fcn.0046d3e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c98ea
xor edx, edx
push ebp
push 0x4ca581
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004c89f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4c9940
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x34]
call fcn.0041d43c
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
call fcn.00403884
inc dword [ebp - 0x34]
dec dword [ebp - 0x3c]
jne 0x4c991c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e8]
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4c9970
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2e8]
push eax
call sub.user32.dll_DestroyWindow
mov eax, dword [ebp - 4]
lea edx, [eax + 0x220]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
mov dword [eax + 0x220], 0x64
mov dword [0x510d68], 0x64
mov eax, dword [ebp - 4]
lea edx, [eax + 0x22c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x230]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x234]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp word [ebp - 0x12], 0xaa55
je 0x4c99fd
mov eax, dword [ebp - 4]
lea edx, [eax + 0x238]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
call fcn.00433cdc
call fcn.00433854
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4c9acd
lea eax, [ebp - 0x115]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00433cdc
lea ecx, [ebp - 0xce]
lea edx, [ebp - 0x87]
call fcn.004334e0
cmp dword [ebp - 0xc], 0
je 0x4c9acd
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x4c9ac6
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 4]
mov dx, word [edx + 0x22c]
mov word [eax + 0x2e], dx
mov edx, dword [ebp - 4]
mov dx, word [edx + 0x230]
mov word [eax + 0x32], dx
mov edx, dword [ebp - 4]
mov dx, word [edx + 0x234]
mov word [eax + 0x30], dx
mov edx, dword [ebp - 4]
mov dx, word [edx + 0x238]
mov word [eax + 0x2c], dx
lea eax, [ebp - 0x115]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.00433cdc
lea ecx, [ebp - 0xce]
lea edx, [ebp - 0x87]
call fcn.00433588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c9acd
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov eax, dword [ebp - 4]
lea edx, [eax + 0x224]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x228]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x224]
mov dword [0x510d60], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
mov dword [0x510d64], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x224]
mov eax, dword [ebp - 4]
call fcn.0044c65c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x228]
mov eax, dword [ebp - 4]
call fcn.0044c680
mov eax, dword [ebp - 4]
lea edx, [eax + 0x23c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x244]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x240]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x248]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2c4]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2cc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2c8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2d0]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2d4]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2d8]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
lea edx, [eax + 0x2dc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4c9ca3
inc eax
mov dword [ebp - 0x3c], eax
mov dl, 1
mov eax, dword [0x4c386c]
call fcn.004c5384
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x2c]
call fcn.0041d290
lea edx, [ebp - 0x1c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x240]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x23c]
push eax
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x2c]
call fcn.004c5444
dec dword [ebp - 0x3c]
jne 0x4c9c45
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4ca2a4
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x34]
call fcn.0041d43c
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4c9d0e
inc eax
mov dword [ebp - 0x40], eax
lea ebx, [ebp - 0x149e]
mov edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 8]
inc ebx
dec dword [ebp - 0x40]
jne 0x4c9cf9
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x149e], 0
lea edx, [ebp - 0x14a4]
lea eax, [ebp - 0x149e]
call fcn.004099b8
mov edx, dword [ebp - 0x14a4]
mov eax, dword [ebp - 0x2c]
add eax, 0x10
call fcn.00404660
cmp word [ebp - 0x12], 0xaa55
je 0x4c9daf
cmp word [ebp - 0x12], 0xaa56
je 0x4c9daf
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4c9d82
inc eax
mov dword [ebp - 0x40], eax
lea ebx, [ebp - 0x149e]
mov edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 8]
inc ebx
dec dword [ebp - 0x40]
jne 0x4c9d6d
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x149e], 0
lea edx, [ebp - 0x14a8]
lea eax, [ebp - 0x149e]
call fcn.004099b8
mov edx, dword [ebp - 0x14a8]
mov eax, dword [ebp - 0x2c]
add eax, 0x14
call fcn.00404660
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0xc]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp word [ebp - 0x12], 0xaa5a
jbe 0x4c9ddd
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x18]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x1c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x20]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x24]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x2c]
lea edx, [eax + 0x28]
mov ecx, 0x10
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x4ca298
inc eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x38]
call fcn.0041d43c
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x28]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x2c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x30]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x34]
mov ecx, 0x10
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x44]
mov ecx, 0x10
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x54]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x58]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x5c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x60]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x64]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x68]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x6c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x70]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x74]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x78]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x7c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x80]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x84]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x88]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x8c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x90]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov esi, dword [ebp - 0x18]
dec esi
test esi, esi
jl 0x4ca03a
inc esi
lea ebx, [ebp - 0x149e]
mov edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 8]
inc ebx
dec esi
jne 0x4ca027
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x149e], 0
lea edx, [ebp - 0x14ac]
lea eax, [ebp - 0x149e]
call fcn.004099b8
mov edx, dword [ebp - 0x14ac]
mov eax, dword [ebp - 0x30]
add eax, 0xc
call fcn.00404660
cmp word [ebp - 0x12], 0xaa5d
jb 0x4ca082
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x14]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp word [ebp - 0x12], 0xaa5c
jb 0x4ca09d
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x10]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x30]
lea edx, [eax + 5]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp word [ebp - 0x12], 0xaa55
je 0x4ca0db
cmp word [ebp - 0x12], 0xaa56
je 0x4ca0db
cmp word [ebp - 0x12], 0xaa57
je 0x4ca0db
mov eax, dword [ebp - 0x30]
lea edx, [eax + 4]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp word [ebp - 0x12], 0xaa59
jbe 0x4ca0f9
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0xd4]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov esi, dword [ebp - 0x18]
dec esi
test esi, esi
jl 0x4ca12b
inc esi
lea ebx, [ebp - 0x149e]
mov edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 8]
inc ebx
dec esi
jne 0x4ca118
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x149e], 0
lea edx, [ebp - 0x14b0]
lea eax, [ebp - 0x149e]
call fcn.004099b8
mov edx, dword [ebp - 0x14b0]
mov eax, dword [ebp - 0x30]
add eax, 8
call fcn.00404660
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov esi, dword [ebp - 0x18]
dec esi
test esi, esi
jl 0x4ca18a
inc esi
lea ebx, [ebp - 0x149e]
mov edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 8]
inc ebx
dec esi
jne 0x4ca177
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x149e], 0
lea edx, [ebp - 0x14b4]
lea eax, [ebp - 0x149e]
call fcn.004099b8
mov edx, dword [ebp - 0x14b4]
mov eax, dword [ebp - 0x30]
add eax, 0x94
call fcn.00404660
mov eax, dword [ebp - 0x30]
lea edx, [eax + 0x98]
mov ecx, 0x3c
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x1c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x18], 0
jl 0x4ca1fb
cmp dword [ebp - 0x1c], 0
jge 0x4ca205
mov eax, dword [ebp - 0x30]
xor edx, edx
mov dword [eax + 0x20], edx
jmp 0x4ca227
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x18]
call fcn.0041d43c
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x1c]
call fcn.0041d43c
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x20], eax
lea edx, [ebp - 0x20]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov esi, dword [ebp - 0x20]
dec esi
test esi, esi
jl 0x4ca28c
inc esi
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
lea edx, [ebp - 0x1c]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x218]
mov edx, dword [ebp - 0x18]
call fcn.0041d43c
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x1c]
call fcn.0041d43c
mov edx, eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0x24]
call fcn.0041d290
dec esi
jne 0x4ca240
inc dword [ebp - 0x38]
dec dword [ebp - 0x40]
jne 0x4c9e46
inc dword [ebp - 0x34]
dec dword [ebp - 0x3c]
jne 0x4c9cc3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4ca2d8
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov edx, dword [ebp - 0x34]
call fcn.0041d43c
call fcn.00403884
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffff
jne 0x4ca2b9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x4ca31a
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [ebp - 0x34]
call fcn.0041d43c
call fcn.00403884
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffff
jne 0x4ca2fb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, dword [eax]
call dword [edx + 8]
xor eax, eax
mov dword [ebp - 0x24], eax
lea edx, [ebp - 0x24]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x24]
dec eax
test eax, eax
jl 0x4ca458
inc eax
mov dword [ebp - 0x3c], eax
mov dl, 1
mov eax, dword [0x4c38e0]
call fcn.00403854
mov esi, eax
xor eax, eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4ca397
inc eax
mov dword [ebp - 0x40], eax
lea ebx, [ebp - 0x149e]
mov edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 8]
inc ebx
dec dword [ebp - 0x40]
jne 0x4ca382
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x149e], 0
lea edx, [ebp - 0x14b8]
lea eax, [ebp - 0x149e]
call fcn.004099b8
mov edx, dword [ebp - 0x14b8]
lea eax, [esi + 4]
call fcn.00404660
xor eax, eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4ca3fd
inc eax
mov dword [ebp - 0x40], eax
lea ebx, [ebp - 0x149e]
mov edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 8]
inc ebx
dec dword [ebp - 0x40]
jne 0x4ca3e8
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x149e], 0
lea edx, [ebp - 0x14bc]
lea eax, [ebp - 0x149e]
call fcn.004099b8
mov edx, dword [ebp - 0x14bc]
lea eax, [esi + 8]
call fcn.00404660
cmp word [ebp - 0x12], 0xaa59
jb 0x4ca43f
lea edx, [esi + 0xc]
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f4]
mov edx, esi
call fcn.0041d290
dec dword [ebp - 0x3c]
jne 0x4ca34d
xor eax, eax
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x28]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x28]
dec eax
test eax, eax
jl 0x4ca56b
inc eax
mov dword [ebp - 0x3c], eax
mov dl, 1
mov eax, dword [0x4c38e0]
call fcn.00403854
mov esi, eax
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4ca4c2
inc eax
mov dword [ebp - 0x40], eax
lea ebx, [ebp - 0x149e]
mov edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 8]
inc ebx
dec dword [ebp - 0x40]
jne 0x4ca4ad
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x149e], 0
lea edx, [ebp - 0x14c0]
lea eax, [ebp - 0x149e]
call fcn.004099b8
mov edx, dword [ebp - 0x14c0]
lea eax, [esi + 4]
call fcn.00404660
xor eax, eax
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
call dword [ebx + 8]
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x4ca528
inc eax
mov dword [ebp - 0x40], eax
lea ebx, [ebp - 0x149e]
mov edx, ebx
mov ecx, 1
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 8]
inc ebx
dec dword [ebp - 0x40]
jne 0x4ca513
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x149e], 0
lea edx, [ebp - 0x14c4]
lea eax, [ebp - 0x149e]
call fcn.004099b8
mov edx, dword [ebp - 0x14c4]
lea eax, [esi + 8]
call fcn.00404660
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2f8]
mov edx, esi
call fcn.0041d290
dec dword [ebp - 0x3c]
jne 0x4ca47d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ca588
mov eax, dword [ebp - 0x10]
call fcn.00403884
ret