Function at 0x429c20
Capabilities:
Access peb ldr_data
Check os version
Get number of processors
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x471f86
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x4ae38c]
xor eax, esp
mov dword [esp + 0x2a0], eax
push ebx
push esi
push edi
mov eax, dword [0x4ae38c]
xor eax, esp
push eax
lea eax, [esp + 0x2b8]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov esi, ecx
mov dword [esp + 0x28], ebx
push ebx
mov dword [esp + 0x30], ebx
push 0x111
lea ecx, [esi + 0x7d0]
mov dword [esi + 0x854], 1
call dword [0x476bb4]
push ebx
mov eax, 1
push ebx
mov dword [esi + 0x844], eax
mov dword [esi + 0x868], eax
mov dword [esi + 0x858], ebx
push 0x119
lea ecx, [esi + 0xf60]
mov dword [esi + 0xfe4], eax
call dword [0x476bb4]
mov edi, dword [0x4772b8]
mov eax, 1
mov dword [esi + 0xfd4], eax
mov dword [esi + 0xff8], eax
mov dword [esi + 0xfe8], ebx
mov eax, dword [0x4cfd70]
push eax
mov eax, dword [esi + 0x2c4]
push ebx
push 0x402
push eax
call edi
push eax
call dword [0x477688]
mov ecx, dword [esi + 0x2c4]
push 0x12
push 0xffffffffffffffff
push 0x153
push ecx
call edi
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x5c]
push edx
lea ecx, [esi + 0x318]
call dword [0x476d1c]
mov ecx, dword [esp + 0x58]
mov eax, dword [0x4cc3ac]
mov eax, dword [eax + 0xc]
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x48]
push 0x404040
push eax
push 0xa5462e
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x60]
push edx
push eax
push ecx
lea ecx, [esi + 0x318]
mov dword [esp + 0x70], 0xa5462e
mov dword [esp + 0x5c], 0x404040
call dword [0x476d20]
mov eax, dword [esi + 0x250]
lea edx, [esp + 0x9c]
push edx
push eax
call dword [0x4772bc]
mov eax, dword [esi + 0x20]
push 2
mov edx, dword [esi + 0x250]
lea ecx, [esp + 0xa0]
push ecx
push eax
push edx
call dword [0x4772e0]
mov eax, dword [esi + 0x318]
mov edx, dword [eax + 0x188]
push 0xffffffffffffffff
push esi
lea ecx, [esp + 0xa4]
push ecx
push 0x50810000
lea ecx, [esi + 0x318]
call edx
mov eax, dword [esi + 0x20]
push 1
push 0x47e420
mov ecx, 0x4d05e4
mov dword [esi + 0x36c], eax
call fcn.004624a0
push eax
push 1
push 0x47db58
mov ecx, 0x4d05e4
call fcn.004624a0
push eax
push 1
lea ecx, [esi + 0x318]
call dword [0x476d24]
mov edx, dword [esi + 0x338]
lea ecx, [esp + 0x9c]
push ecx
push edx
call dword [0x477278]
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x9c]
mov dword [esp + 0x70], 1
lea ecx, [eax + eax*2]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi + 0x318]
mov dword [esp + 0x74], eax
mov eax, dword [edx + 0x174]
lea ecx, [esi + 0x318]
call eax
mov edx, dword [eax + 0x20]
lea ecx, [esp + 0x70]
push ecx
push ebx
push 0x120c
push edx
call edi
push 0xe8
call dword [0x477a4c]
mov edi, eax
add esp, 4
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c0], ebx
test edi, edi
je 0x429f31
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ebx, eax
mov eax, 8
push ebx
mov word [esp + 0x30], ax
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x429ecd
test ebx, ebx
je 0x429ecd
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 1
push 0x485310
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], 1
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x2c]
mov dword [esp + 0x2d8], 2
mov ebx, 3
push edx
mov ecx, edi
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov dword [edi], 0x47e684
jmp 0x429f33
xor edi, edi
mov dword [esi + 0x170c], edi
test bl, 2
je 0x429f4b
lea ecx, [esp + 0x14]
and ebx, 0xfffffffd
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test bl, 1
je 0x429f69
lea eax, [esp + 0x2c]
push eax
and ebx, 0xfffffffe
call dword [0x477208]
push 0xe8
call dword [0x477a4c]
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c0], 5
test edi, edi
je 0x42a02f
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x429fce
cmp dword [esp + 0x20], eax
je 0x429fce
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 6
or ebx, 4
push 0x480ee4
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x2c]
or ebx, 8
mov dword [esp + 0x2d8], 7
push eax
mov ecx, edi
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov dword [edi], 0x47e684
jmp 0x42a031
xor edi, edi
mov dword [esi + 0x16fc], edi
test bl, 8
je 0x42a049
lea ecx, [esp + 0x14]
and ebx, 0xfffffff7
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test bl, 4
je 0x42a067
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xfffffffb
call dword [0x477208]
push 0xe8
call dword [0x477a4c]
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c0], 0xa
test edi, edi
je 0x42a12d
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov edx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], dx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42a0cc
cmp dword [esp + 0x20], eax
je 0x42a0cc
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0xb
or ebx, 0x10
push 0x47e47c
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
or ebx, 0x20
push ecx
mov dword [esp + 0x2dc], 0xc
mov ecx, edi
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov dword [edi], 0x47e684
jmp 0x42a12f
xor edi, edi
mov dword [esi + 0x1708], edi
test bl, 0x20
je 0x42a147
lea ecx, [esp + 0x14]
and ebx, 0xffffffdf
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test bl, 0x10
je 0x42a165
lea edx, [esp + 0x2c]
push edx
and ebx, 0xffffffef
call dword [0x477208]
push 0xe8
call dword [0x477a4c]
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c0], 0xf
test edi, edi
je 0x42a22e
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42a1ca
cmp dword [esp + 0x20], eax
je 0x42a1ca
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x10
or ebx, 0x40
push 0x480edc
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x2c]
or ebx, 0x80
mov dword [esp + 0x2d8], 0x11
push eax
mov ecx, edi
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov dword [edi], 0x47e684
jmp 0x42a230
xor edi, edi
mov dword [esi + 0x1700], edi
test bl, bl
jns 0x42a24a
lea ecx, [esp + 0x14]
and ebx, 0xffffff7f
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test bl, 0x40
je 0x42a268
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xffffffbf
call dword [0x477208]
push 0xe8
call dword [0x477a4c]
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
mov dword [esp + 0x2c0], 0x14
test edi, edi
je 0x42a334
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov edx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], dx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42a2cd
cmp dword [esp + 0x20], eax
je 0x42a2cd
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x15
or ebx, 0x100
push 0x48532c
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
or ebx, 0x200
push ecx
mov dword [esp + 0x2dc], 0x16
mov ecx, edi
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov dword [edi], 0x47e684
jmp 0x42a336
xor edi, edi
mov dword [esi + 0x1704], edi
test ebx, 0x200
je 0x42a354
lea ecx, [esp + 0x14]
and ebx, 0xfffffdff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x100
je 0x42a378
lea edx, [esp + 0x2c]
push edx
and ebx, 0xfffffeff
call dword [0x477208]
push 1
push 1
push 0x484628
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1704]
mov edi, dword [0x476d30]
push eax
call edi
push 1
push 1
push 0x485348
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1704]
push eax
call edi
push 1
push 1
push 0x485364
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1704]
push eax
call edi
push 1
push 1
push 0x48536c
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1704]
push eax
call edi
push 1
push 1
push 0x485378
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1704]
push eax
call edi
push 1
push 1
push 0x485380
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1704]
push eax
call edi
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c0], 0x19
test eax, eax
je 0x42a4f6
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42a489
cmp dword [esp + 0x20], eax
je 0x42a489
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x1a
or ebx, 0x400
push 0x485388
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x1c]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
mov dword [esp + 0x2d4], 0x1b
mov ecx, dword [esp + 0x28]
push edx
lea eax, [esp + 0x30]
or ebx, 0x800
push eax
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x14]
mov dword [eax], 0x47e684
jmp 0x42a4f8
xor eax, eax
mov dword [esi + 0x1710], eax
test ebx, 0x800
je 0x42a516
lea ecx, [esp + 0x18]
and ebx, 0xfffff7ff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x400
je 0x42a53a
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xfffffbff
call dword [0x477208]
push 1
push 1
push 0x48364c
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1710]
push eax
call edi
push 1
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1710]
push eax
call edi
mov edx, dword [esi + 0x170c]
mov ecx, dword [esi + 0x16f8]
push edx
call dword [0x476d34]
mov eax, dword [esi + 0x16fc]
mov ecx, dword [esi + 0x16f8]
push eax
call dword [0x476d34]
mov ecx, dword [esi + 0x1708]
push ecx
mov ecx, dword [esi + 0x16f8]
call dword [0x476d34]
mov edx, dword [esi + 0x1700]
mov ecx, dword [esi + 0x16f8]
push edx
call dword [0x476d34]
mov eax, dword [esi + 0x1704]
mov ecx, dword [esi + 0x16f8]
push eax
call dword [0x476d34]
mov ecx, dword [esi + 0x1710]
push ecx
mov ecx, dword [esi + 0x16f8]
call dword [0x476d34]
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c0], 0x1e
test eax, eax
je 0x42a6b4
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov edx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], dx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42a647
cmp dword [esp + 0x20], eax
je 0x42a647
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x1f
or ebx, 0x1000
push 0x47e454
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2d8], 0x20
or ebx, 0x2000
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x18]
mov dword [eax], 0x47e684
jmp 0x42a6b6
xor eax, eax
mov dword [esi + 0x172c], eax
test ebx, 0x2000
je 0x42a6d4
lea ecx, [esp + 0x14]
and ebx, 0xffffdfff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x1000
je 0x42a6f8
lea edx, [esp + 0x2c]
push edx
and ebx, 0xffffefff
call dword [0x477208]
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c0], 0x23
test eax, eax
je 0x42a7c8
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42a75b
cmp dword [esp + 0x20], eax
je 0x42a75b
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x24
or ebx, 0x4000
push 0x47e47c
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
mov dword [esp + 0x2d4], 0x25
mov ecx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
or ebx, 0x8000
push eax
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x18]
mov dword [eax], 0x47e684
jmp 0x42a7ca
xor eax, eax
mov dword [esi + 0x1730], eax
test ebx, 0x8000
je 0x42a7e8
lea ecx, [esp + 0x14]
and ebx, 0xffff7fff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x4000
je 0x42a80c
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xffffbfff
call dword [0x477208]
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c0], 0x28
test eax, eax
je 0x42a8dc
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov edx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], dx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42a86f
cmp dword [esp + 0x20], eax
je 0x42a86f
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x29
or ebx, 0x10000
push 0x47e4a0
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2d8], 0x2a
or ebx, 0x20000
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x18]
mov dword [eax], 0x47e684
jmp 0x42a8de
xor eax, eax
mov dword [esi + 0x1734], eax
test ebx, 0x20000
je 0x42a8fc
lea ecx, [esp + 0x14]
and ebx, 0xfffdffff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x10000
je 0x42a920
lea edx, [esp + 0x2c]
push edx
and ebx, 0xfffeffff
call dword [0x477208]
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c0], 0x2d
test eax, eax
je 0x42a9f0
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42a983
cmp dword [esp + 0x20], eax
je 0x42a983
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x2e
or ebx, 0x40000
push 0x4853a4
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
mov dword [esp + 0x2d4], 0x2f
mov ecx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
or ebx, 0x80000
push eax
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x18]
mov dword [eax], 0x47e684
jmp 0x42a9f2
xor eax, eax
mov dword [esi + 0x1738], eax
test ebx, 0x80000
je 0x42aa10
lea ecx, [esp + 0x14]
and ebx, 0xfff7ffff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x40000
je 0x42aa34
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xfffbffff
call dword [0x477208]
push 1
push 0x47e4e0
mov ecx, 0x4d05e4
call fcn.004624a0
lea edx, [esp + 0xac]
test edx, edx
je 0x42aa8c
test eax, eax
je 0x42aa82
mov cx, word [eax]
mov word [esp + 0xac], cx
test cx, cx
je 0x42aa8c
sub edx, eax
jmp 0x42aa70
movzx ecx, word [eax + 2]
add eax, 2
mov word [edx + eax], cx
test cx, cx
jne 0x42aa70
jmp 0x42aa8c
xor eax, eax
mov word [esp + 0xac], ax
cmp word [esp + 0xac], 0
mov eax, 0x4853c0
lea ecx, [esp + 0xac]
je 0x42aaac
add ecx, 2
cmp word [ecx], 0
jne 0x42aaa3
mov edx, ecx
sub edx, 0x4853c0
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x42aab4
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c0], 0x32
test eax, eax
je 0x42ab72
mov ecx, 8
push 0x4853d0
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42ab0f
push 0x8007000e
call fcn.0046df60
lea edx, [esp + 0xac]
mov byte [esp + 0x2c0], 0x33
or ebx, 0x100000
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2d8], 0x34
or ebx, 0x200000
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x18]
mov dword [eax], 0x47e684
jmp 0x42ab74
xor eax, eax
mov dword [esi + 0x1740], eax
test ebx, 0x200000
je 0x42ab92
lea ecx, [esp + 0x14]
and ebx, 0xffdfffff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x100000
je 0x42abb6
lea edx, [esp + 0x2c]
push edx
and ebx, 0xffefffff
call dword [0x477208]
push 1
push 1
push 0x4853dc
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1740]
push eax
call edi
push 1
push 1
push 0x4853e8
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1740]
push eax
call edi
push 1
push 1
push 0x4853f4
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1740]
push eax
call edi
push 1
push 1
push 0x485400
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1740]
push eax
call edi
push 1
push 1
push 0x4853d0
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1740]
push eax
call edi
push 1
push 1
push 0x48540c
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1740]
push eax
call edi
push 1
push 1
push 0x485418
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1740]
push eax
call edi
push 1
push 1
push 0x485424
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1740]
push eax
call edi
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c0], 0x37
test eax, eax
je 0x42ad66
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42acf9
cmp dword [esp + 0x20], eax
je 0x42acf9
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x38
or ebx, 0x400000
push 0x485434
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
mov dword [esp + 0x2d4], 0x39
mov ecx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
or ebx, 0x800000
push eax
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x18]
mov dword [eax], 0x47e684
jmp 0x42ad68
xor eax, eax
mov dword [esi + 0x1744], eax
test ebx, 0x800000
je 0x42ad86
lea ecx, [esp + 0x14]
and ebx, 0xff7fffff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x400000
je 0x42adaa
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xffbfffff
call dword [0x477208]
push 1
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1744]
push eax
call edi
mov dword [esp + 0x14], 0
mov edi, edi
mov eax, dword [esp + 0x14]
push 0xa
lea edx, [esp + 0xb0]
push edx
push eax
call fcn.00402e30
add esp, 0xc
push 1
lea ecx, [esp + 0xb0]
push ecx
mov ecx, dword [esi + 0x1744]
call edi
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0xa
jl 0x42add0
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c0], 0x3c
test eax, eax
je 0x42aed7
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov edx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], dx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42ae6a
cmp dword [esp + 0x20], eax
je 0x42ae6a
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x3d
or ebx, 0x1000000
push 0x48545c
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x18]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2d8], 0x3e
or ebx, 0x2000000
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x18]
mov dword [eax], 0x47e684
jmp 0x42aed9
xor eax, eax
mov dword [esi + 0x173c], eax
test ebx, 0x2000000
je 0x42aef7
lea ecx, [esp + 0x14]
and ebx, 0xfdffffff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x1000000
je 0x42af1b
lea edx, [esp + 0x2c]
push edx
and ebx, 0xfeffffff
call dword [0x477208]
push 1
push 1
push 0x48364c
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x173c]
push eax
call edi
push 1
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x173c]
push eax
call edi
mov eax, dword [esi + 0x1738]
mov ecx, dword [esi + 0x1728]
push eax
call dword [0x476d34]
mov ecx, dword [esi + 0x172c]
push ecx
mov ecx, dword [esi + 0x1728]
call dword [0x476d34]
mov edx, dword [esi + 0x1730]
mov ecx, dword [esi + 0x1728]
push edx
call dword [0x476d34]
mov eax, dword [esi + 0x1734]
mov ecx, dword [esi + 0x1728]
push eax
call dword [0x476d34]
mov ecx, dword [esi + 0x173c]
push ecx
mov ecx, dword [esi + 0x1728]
call dword [0x476d34]
mov edx, dword [esi + 0x1740]
mov ecx, dword [esi + 0x1728]
push edx
call dword [0x476d34]
mov eax, dword [esi + 0x1744]
mov ecx, dword [esi + 0x1728]
push eax
call dword [0x476d34]
push 1
push 0x485280
mov ecx, 0x4d05e4
call fcn.004624a0
push eax
lea ecx, [esp + 0xb0]
push 0x485478
push ecx
call fcn.00402330
add esp, 0xc
push 0xf0
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c0], 0x41
test eax, eax
je 0x42b10a
push 0x4854a8
lea ecx, [esp + 0x20]
call dword [0x477660]
mov byte [esp + 0x2c0], 0x42
mov edx, 8
or ebx, 0x4000000
push 0x47de3c
mov dword [esp + 0x28], ebx
mov word [esp + 0x30], dx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42b06c
push 0x8007000e
call fcn.0046df60
lea eax, [esp + 0xac]
mov dword [esp + 0x2c0], 0x43
or ebx, 0x8000000
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], ebx
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x2d8], 0x44
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x30]
or ebx, 0x10000000
push edx
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov dword [esp + 0x2c0], 0x45
mov eax, dword [esp + 0x14]
lea ecx, [eax + 0xe8]
mov dword [eax], 0x485ad4
call dword [0x47777c]
mov byte [esp + 0x2c0], 0x46
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
add ecx, 0xe8
call dword [0x477730]
mov eax, dword [esp + 0x14]
jmp 0x42b10c
xor eax, eax
mov dword [esi + 0x1718], eax
test ebx, 0x10000000
je 0x42b12a
lea ecx, [esp + 0x18]
and ebx, 0xefffffff
call dword [0x477778]
test ebx, 0x8000000
je 0x42b143
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xf7ffffff
call dword [0x477208]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x4000000
je 0x42b166
lea ecx, [esp + 0x1c]
and ebx, 0xfbffffff
call dword [0x477778]
push 1
push 0x480ee4
mov ecx, 0x4d05e4
call fcn.004624a0
push eax
push 1
push 0x485558
mov ecx, 0x4d05e4
call fcn.004624a0
push eax
lea edx, [esp + 0xb4]
push 0x485580
push edx
call fcn.00402330
push 0xe8
call dword [0x477a4c]
add esp, 0x14
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c0], 0x4a
test eax, eax
je 0x42b262
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42b1ff
cmp dword [esp + 0x20], eax
je 0x42b1ff
push 0x8007000e
call fcn.0046df60
lea edx, [esp + 0xac]
mov byte [esp + 0x2c0], 0x4b
or ebx, 0x20000000
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x28], ebx
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x2d8], 0x4c
or ebx, 0x40000000
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x40], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x47e684
jmp 0x42b264
xor eax, eax
mov dword [esi + 0x171c], eax
test ebx, 0x40000000
je 0x42b282
lea ecx, [esp + 0x18]
and ebx, 0xbfffffff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x20000000
je 0x42b2a6
lea edx, [esp + 0x2c]
push edx
and ebx, 0xdfffffff
call dword [0x477208]
call dword [0x476f24]
push eax
lea eax, [esp + 0xb0]
push 0x47e8f8
push eax
call fcn.00402330
add esp, 0xc
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c0], 0x4f
test eax, eax
je 0x42b37c
lea edx, [esp + 0xac]
mov ecx, 8
push edx
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42b311
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x50
or ebx, 0x80000000
push 0x485598
mov ecx, 0x4d05e4
mov dword [esp + 0x2c], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x1c]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x2d8], 0x51
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x44], 1
call dword [0x476d28]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x47e684
jmp 0x42b37e
xor eax, eax
test byte [esp + 0x28], 1
mov dword [esi + 0x1720], eax
je 0x42b39a
and dword [esp + 0x28], 0xfffffffe
lea ecx, [esp + 0x18]
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, ebx
jns 0x42b3b4
lea edx, [esp + 0x2c]
push edx
call dword [0x477208]
mov eax, dword [0x4b6ca8]
xor ebx, ebx
test eax, eax
je 0x42b3d7
nop
mov ecx, dword [esi + 0x1720]
push 1
push eax
call edi
mov eax, dword [ebx*4 + 0x4b6cac]
inc ebx
test eax, eax
jne 0x42b3c0
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c0], 0x54
test eax, eax
je 0x42b4a1
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ebx, eax
mov eax, 8
push ebx
mov word [esp + 0x30], ax
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42b436
test ebx, ebx
je 0x42b436
push 0x8007000e
call fcn.0046df60
mov byte [esp + 0x2c0], 0x55
mov ebx, dword [esp + 0x28]
push 1
or ebx, 2
push 0x4855b8
mov ecx, 0x4d05e4
mov dword [esp + 0x30], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x1c]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
mov dword [esp + 0x2d8], 0x56
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x30]
or ebx, 4
push edx
mov dword [esp + 0x44], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x47e684
jmp 0x42b4a7
mov ebx, dword [esp + 0x28]
xor eax, eax
mov dword [esi + 0x1724], eax
test bl, 4
je 0x42b4bf
lea ecx, [esp + 0x18]
and ebx, 0xfffffffb
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test bl, 2
je 0x42b4dd
lea eax, [esp + 0x2c]
push eax
and ebx, 0xfffffffd
call dword [0x477208]
push 1
push 1
push 0x47be74
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1724]
push eax
call edi
push 1
push 1
push 0x481154
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1724]
push eax
call edi
mov dword [esp + 0x14], 0
lea ecx, [ecx]
mov edx, dword [esp + 0x14]
push 0xa
lea ecx, [esp + 0xb0]
push ecx
push edx
call fcn.00402e30
mov ecx, dword [esi + 0x1724]
add esp, 0xc
push 1
lea eax, [esp + 0xb0]
push eax
call edi
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0xa
jl 0x42b520
mov ecx, dword [esi + 0x1718]
push ecx
mov ecx, dword [esi + 0x1714]
call dword [0x476d34]
mov edx, dword [esi + 0x171c]
mov ecx, dword [esi + 0x1714]
push edx
call dword [0x476d34]
mov eax, dword [esi + 0x1720]
mov ecx, dword [esi + 0x1714]
push eax
call dword [0x476d34]
mov ecx, dword [esi + 0x1724]
push ecx
mov ecx, dword [esi + 0x1714]
call dword [0x476d34]
push 1
push 0x4852a8
mov ecx, 0x4d05e4
call fcn.004624a0
push eax
lea edx, [esp + 0xb0]
push 0x4855e4
push edx
call fcn.00402330
add esp, 0xc
push 0xf0
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c0], 0x59
test eax, eax
je 0x42b6cc
push 0x485608
lea ecx, [esp + 0x1c]
call dword [0x477660]
mov byte [esp + 0x2c0], 0x5a
mov eax, 8
or ebx, 8
push 0x47de3c
mov dword [esp + 0x2c], ebx
mov word [esp + 0x30], ax
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42b634
push 0x8007000e
call fcn.0046df60
lea ecx, [esp + 0xac]
push ecx
mov dword [esp + 0x2c4], 0x5b
or ebx, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], ebx
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
mov dword [esp + 0x2d4], 0x5c
mov ecx, dword [esp + 0x28]
push edx
lea eax, [esp + 0x34]
or ebx, 0x20
push eax
mov dword [esp + 0x44], ebx
call dword [0x476d28]
mov dword [esp + 0x2c0], 0x5d
mov eax, dword [esp + 0x14]
lea ecx, [eax + 0xe8]
mov dword [eax], 0x485ad4
call dword [0x47777c]
lea ecx, [esp + 0x18]
push ecx
mov byte [esp + 0x2c4], 0x5e
mov ecx, dword [esp + 0x18]
add ecx, 0xe8
call dword [0x477730]
mov eax, dword [esp + 0x14]
jmp 0x42b6ce
xor eax, eax
mov dword [esi + 0x174c], eax
test bl, 0x20
je 0x42b6e6
lea ecx, [esp + 0x1c]
and ebx, 0xffffffdf
call dword [0x477778]
test bl, 0x10
je 0x42b6f9
lea edx, [esp + 0x2c]
push edx
and ebx, 0xffffffef
call dword [0x477208]
mov dword [esp + 0x2c0], 0xffffffff
test bl, 8
je 0x42b716
lea ecx, [esp + 0x18]
and ebx, 0xfffffff7
call dword [0x477778]
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c0], 0x62
test eax, eax
je 0x42b7e3
push 1
push 0x484360
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42b779
cmp dword [esp + 0x20], eax
je 0x42b779
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x63
or ebx, 0x40
push 0x4845c8
mov ecx, 0x4d05e4
mov dword [esp + 0x30], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x1c]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
mov dword [esp + 0x2d4], 0x64
mov ecx, dword [esp + 0x30]
push edx
lea eax, [esp + 0x30]
or ebx, 0x80
push eax
mov dword [esp + 0x44], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x47e684
jmp 0x42b7e5
xor eax, eax
mov dword [esi + 0x1750], eax
test bl, bl
jns 0x42b7ff
lea ecx, [esp + 0x18]
and ebx, 0xffffff7f
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test bl, 0x40
je 0x42b81d
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xffffffbf
call dword [0x477208]
push 1
push 1
push 0x4843b0
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1750]
push eax
call edi
push 1
push 1
push 0x484398
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1750]
push eax
call edi
push 1
push 1
push 0x484384
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1750]
push eax
call edi
push 1
push 1
push 0x484370
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1750]
push eax
call edi
push 1
push 1
push 0x484360
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1750]
push eax
call edi
mov eax, dword [esi + 0x1750]
push 0xe8
mov dword [eax + 0xa0], 0
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c0], 0x67
test eax, eax
je 0x42b972
mov edx, 8
push 0x485730
mov word [esp + 0x30], dx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42b905
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x68
or ebx, 0x100
push 0x4845dc
mov ecx, 0x4d05e4
mov dword [esp + 0x30], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x1c]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x2d8], 0x69
or ebx, 0x200
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x44], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x47e684
jmp 0x42b974
xor eax, eax
mov dword [esi + 0x1754], eax
test ebx, 0x200
je 0x42b992
lea ecx, [esp + 0x18]
and ebx, 0xfffffdff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x100
je 0x42b9b6
lea edx, [esp + 0x2c]
push edx
and ebx, 0xfffffeff
call dword [0x477208]
mov ecx, dword [esi + 0x1754]
push 1
push 0x485730
call edi
mov ecx, dword [esi + 0x1754]
push 1
push 0x485738
call edi
mov ecx, dword [esi + 0x1754]
push 1
push 0x485740
call edi
mov eax, dword [esi + 0x174c]
mov ecx, dword [esi + 0x1748]
push eax
call dword [0x476d34]
mov ecx, dword [esi + 0x1750]
push ecx
mov ecx, dword [esi + 0x1748]
call dword [0x476d34]
mov edx, dword [esi + 0x1754]
mov ecx, dword [esi + 0x1748]
push edx
call dword [0x476d34]
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c0], 0x6c
test eax, eax
je 0x42baec
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42ba7f
cmp dword [esp + 0x20], eax
je 0x42ba7f
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x6d
or ebx, 0x400
push 0x48455c
mov ecx, 0x4d05e4
mov dword [esp + 0x30], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x1c]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
mov dword [esp + 0x2d4], 0x6e
mov ecx, dword [esp + 0x30]
push edx
lea eax, [esp + 0x30]
or ebx, 0x800
push eax
mov dword [esp + 0x44], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x47e684
jmp 0x42baee
xor eax, eax
mov dword [esi + 0x175c], eax
test ebx, 0x800
je 0x42bb0c
lea ecx, [esp + 0x18]
and ebx, 0xfffff7ff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x400
je 0x42bb30
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xfffffbff
call dword [0x477208]
push 1
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x175c]
push eax
call edi
push 1
push 1
push 0x482cb0
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x175c]
push eax
call edi
push 1
push 1
push 0x482cbc
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x175c]
push eax
call edi
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c0], 0x71
test eax, eax
je 0x42bc54
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov edx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], dx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42bbe7
cmp dword [esp + 0x20], eax
je 0x42bbe7
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x72
or ebx, 0x1000
push 0x485748
mov ecx, 0x4d05e4
mov dword [esp + 0x30], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x1c]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x2d8], 0x73
or ebx, 0x2000
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x44], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x47e684
jmp 0x42bc56
xor eax, eax
mov dword [esi + 0x1760], eax
test ebx, 0x2000
je 0x42bc74
lea ecx, [esp + 0x18]
and ebx, 0xffffdfff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x1000
je 0x42bc98
lea edx, [esp + 0x2c]
push edx
and ebx, 0xffffefff
call dword [0x477208]
push 1
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1760]
push eax
call edi
push 1
push 1
push 0x48364c
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1760]
push eax
call edi
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c0], 0x76
test eax, eax
je 0x42bda0
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, 8
push eax
mov dword [esp + 0x24], eax
mov word [esp + 0x30], cx
call dword [0x477204]
mov dword [esp + 0x34], eax
test eax, eax
jne 0x42bd33
cmp dword [esp + 0x20], eax
je 0x42bd33
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x77
or ebx, 0x4000
push 0x48575c
mov ecx, 0x4d05e4
mov dword [esp + 0x30], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x1c]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x40]
mov dword [esp + 0x2d4], 0x78
mov ecx, dword [esp + 0x30]
push edx
lea eax, [esp + 0x30]
or ebx, 0x8000
push eax
mov dword [esp + 0x44], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x47e684
jmp 0x42bda2
xor eax, eax
mov dword [esi + 0x1764], eax
test ebx, 0x8000
je 0x42bdc0
lea ecx, [esp + 0x18]
and ebx, 0xffff7fff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x4000
je 0x42bde4
lea ecx, [esp + 0x2c]
push ecx
and ebx, 0xffffbfff
call dword [0x477208]
push 1
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1764]
push eax
call edi
push 1
push 1
push 0x48364c
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x1764]
push eax
call edi
push 0xe8
call dword [0x477a4c]
add esp, 4
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c0], 0x7b
test eax, eax
je 0x42beec
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov edx, 8
push eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x60], dx
call dword [0x477204]
mov dword [esp + 0x64], eax
test eax, eax
jne 0x42be7f
cmp dword [esp + 0x18], eax
je 0x42be7f
push 0x8007000e
call fcn.0046df60
push 1
mov byte [esp + 0x2c4], 0x7c
or ebx, 0x10000
push 0x485770
mov ecx, 0x4d05e4
mov dword [esp + 0x30], ebx
call fcn.004624a0
push eax
lea ecx, [esp + 0x24]
call dword [0x477660]
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x2d8], 0x7d
or ebx, 0x20000
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x44], ebx
call dword [0x476d28]
mov eax, dword [esp + 0x1c]
mov dword [eax], 0x47e684
jmp 0x42beee
xor eax, eax
mov dword [esi + 0x176c], eax
test ebx, 0x20000
je 0x42bf0c
lea ecx, [esp + 0x20]
and ebx, 0xfffdffff
call dword [0x477778]
mov dword [esp + 0x2c0], 0xffffffff
test ebx, 0x10000
je 0x42bf2a
lea edx, [esp + 0x5c]
push edx
call dword [0x477208]
push 1
push 1
push 0x483654
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x176c]
push eax
call edi
push 1
push 1
push 0x48364c
mov ecx, 0x4d05e4
call fcn.004624a0
mov ecx, dword [esi + 0x176c]
push eax
call edi
mov eax, dword [esi + 0x175c]
mov ecx, dword [esi + 0x1758]
mov edi, dword [0x476d34]
push eax
call edi
mov ecx, dword [esi + 0x1760]
push ecx
mov ecx, dword [esi + 0x1758]
call edi
mov edx, dword [esi + 0x1764]
mov ecx, dword [esi + 0x1758]
push edx
call edi
mov eax, dword [esi + 0x176c]
mov ecx, dword [esi + 0x1758]
push eax
call edi
mov ecx, dword [esi + 0x170c]
xor eax, eax
mov dword [ecx + 0xa0], eax
mov edx, dword [esi + 0x1738]
mov dword [edx + 0xa0], eax
mov ecx, dword [esi + 0x1734]
mov dword [ecx + 0xa0], eax
mov edx, dword [esi + 0x1710]
mov dword [edx + 0xa0], eax
mov ecx, dword [esi + 0x173c]
mov dword [ecx + 0xa0], eax
mov edx, dword [esi + 0x175c]
mov dword [edx + 0xa0], eax
mov ecx, dword [esi + 0x1760]
mov dword [ecx + 0xa0], eax
mov edx, dword [esi + 0x1764]
mov dword [edx + 0xa0], eax
call fcn.0042c030
mov ecx, dword [esp + 0x2b8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2a0]
xor ecx, esp
call fcn.0046c536
mov esp, ebp
pop ebp
ret